nprasad2077/docker-docs
1
0 Fork 0
mirror of https://github.com/docker/docs.git synced 2026-11-04 10:01:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

Move admin workflows into Organization manuals (#26493)

Browse Source 
Move rollout planning into Organization Setup and ongoing user access
guidance into Organization Manage. Preserve the planning, pilot,
provisioning, and review workflows while linking to canonical feature
procedures. Update navigation and the pilot tutorial, and retain both
guide URLs and all seven chapter redirects.

Validation: scoped rumdl and Vale passed with no alerts; Hugo build and
focused rendered checks passed for redirects, links, retained anchors,
cards, and sidebar order. Full validation reached htmltest but its
container failed with an ARM exec format error.
This commit is contained in:
David Karlsson authored and GitHub committed 2026-10-30 14:33:18 +01:00
1 parent 6a5bbded16
commit 1ff6054807
9 files changed
+305 -529
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

content/get-started/tutorials/admin-set-up.md
+1 -1
View File
@@ -76,7 +76,7 @@ pilot's feedback to refine the policy and its deployment communication.
Continue with these guides when you're ready to expand the deployment:
- [Set up your company for success with Docker](/guides/admin-set-up/) for the
- [Plan and roll out Docker](/manuals/accounts/organization/setup/rollout.md) for the
full deployment handbook
- [Manage organization members](/manuals/accounts/organization/manage/members.md)
for roles, teams, and bulk invitations
content/guides/admin-set-up.md
-330
View File
@@ -1,330 +0,0 @@
---
title: Set up your company for success with Docker
linkTitle: Admin set up
summary: Get the most out of Docker by streamlining workflows, standardizing development environments, and ensuring smooth deployments across your company.
description: Learn how to onboard your company and take advantage of all of the Docker products and features.
keywords: admin, onboarding, deployment, organization setup, docker business, rollout
aliases:
- /guides/admin-set-up/comms-and-info-gathering/
- /guides/admin-set-up/deploy/
- /guides/admin-set-up/finalize-plans-and-setup/
- /guides/admin-set-up/testing/
params:
tags: [admin]
time: 20 minutes
image:
---
Docker's tools provide a scalable, secure platform that empowers your
developers to create, ship, and run applications faster. As an administrator,
you can streamline workflows, standardize development environments, and ensure
smooth deployments across your organization.
By configuring Docker products to suit your company's needs, you can optimize
performance, simplify user management, and maintain control over resources.
This guide helps you set up and configure Docker products to maximize
productivity and success for your team while meeting compliance and security
policies.
## Who’s this for?
- Administrators responsible for managing Docker environments within their
organization
- IT leaders looking to streamline development and deployment workflows
- Teams aiming to standardize application environments across multiple users
- Organizations seeking to optimize their use of Docker products for greater
scalability and efficiency
- Organizations with a
[Docker Business subscription](https://www.docker.com/pricing?ref=DocsGuides&refAction=DocsGuidesCTAClicked)
## What you’ll learn
- Why signing into your company's Docker organization provides access to usage
data and enhanced functionality
- How to standardize Docker Desktop versions and settings to create a consistent
baseline for all users, while allowing flexibility for advanced developers
- Strategies for implementing Docker's security configurations to meet company
IT and software development security requirements without hindering developer productivity
## Features covered
This guide covers the following Docker features:
- [Organizations](/manuals/accounts/organization/_index.md): The core structure
for managing your Docker environment, grouping users, teams, and image
repositories. Your organization was created with your subscription and is
managed by one or more owners. Users signed into the organization are
assigned seats based on the purchased subscription.
- [Enforce sign-in](/manuals/desktop/enterprise/enforce-sign-in/_index.md):
By default, Docker Desktop doesn't require sign-in. You can configure
settings to enforce this and ensure your developers sign in to your
Docker organization.
- [SSO](/manuals/security/authentication/single-sign-on/_index.md): Without SSO,
user management in a Docker organization is manual. Setting
up an SSO connection between your identity provider and Docker ensures
compliance with your security policy and automates user provisioning. Adding
SCIM further automates user provisioning and de-provisioning.
- General and security settings: Configuring key settings ensures smooth
onboarding and usage of Docker products within your environment. You can also
enable security features based on your company's specific security needs.
## Who needs to be involved
- Docker organization owner: Must be involved in the process and is required
for several key steps
- DNS team: Needed during the SSO setup to verify the company domain
- MDM team: Responsible for distributing Docker-specific configuration files to
developer machines
- Identity Provider team: Required for configuring the identity provider and
establishing the SSO connection during setup
- Development lead: A development lead with knowledge of Docker configurations
to help establish a baseline for developer settings
- IT team: An IT representative familiar with company desktop policies to
assist with aligning Docker configuration to those policies
- Infosec: A security team member with knowledge of company development
security policies to help configure security features
- Docker testers: A small group of developers to test the new settings and
configurations before full deployment
## Tools integration
This guide covers integration with:
- Okta
- Entra ID SAML 2.0
- Azure Connect (OIDC)
- MDM solutions like Intune
## Communication and information gathering
### Communicate with your developers and IT teams
Before rolling out Docker Desktop across your organization, coordinate with key stakeholders to ensure a smooth transition.
#### Notify Docker Desktop users
You may already have Docker Desktop users within your company. Some steps in
this onboarding process may affect how they interact with the platform.
Communicate early with users to inform them that:
- They'll be upgraded to a supported version of Docker Desktop as part of the subscription onboarding
- Settings will be reviewed and optimized for productivity
- They'll need to sign in to the company's Docker organization using their
business email to access subscription benefits
#### Engage with your MDM team
Device management solutions, such as Intune and Jamf, are commonly used for
software distribution across enterprises. These tools are typically managed by a dedicated MDM team.
Engage with this team early in the process to:
- Understand their requirements and lead time for deploying changes
- Coordinate the distribution of configuration files
Several setup steps in this guide require JSON files, registry keys, or .plist
files to be distributed to developer machines. Use MDM tools to deploy these configuration files and ensure their integrity.
### Identify Docker organizations
Some companies may have more than one
[Docker organization](/manuals/accounts/organization/_index.md) created. These
organizations may have been created for specific purposes, or may not be
needed anymore.
If you suspect your company has multiple Docker organizations:
- Survey your teams to see if they have their own organizations
- Contact your Docker Support to get a list of organizations with users whose
emails match your domain name
### Gather requirements
[Settings Management](/manuals/desktop/enterprise/hardened-desktop/settings-management/_index.md) lets you preset numerous configuration parameters for Docker Desktop.
Work with the following stakeholders to establish your company's baseline
configuration:
- Docker organization owner
- Development lead
- Information security representative
Review these areas together:
- Security features and
[enforcing sign-in](/manuals/desktop/enterprise/enforce-sign-in/_index.md)
for Docker Desktop users
- Additional Docker products included in your subscriptions
To view the parameters that can be preset, see [Configure Settings Management](/manuals/desktop/enterprise/hardened-desktop/settings-management/configure-json-file.md#step-two-configure-the-settings-you-want-to-lock-in).
### Optional: Meet with the Docker Implementation team
The Docker Implementation team can help you set up your organization,
configure SSO, enforce sign-in, and configure Docker Desktop.
To schedule a meeting, email successteam@docker.com.
## Finalize plans and begin setup
### Send finalized settings files to the MDM team
After reaching an agreement with the relevant teams about your baseline and
security configurations as outlined in the previous section, configure Settings Management either via [Docker Home](/manuals/desktop/enterprise/hardened-desktop/settings-management/configure-admin-console.md) or with an
[`admin-settings.json` file](/manuals/desktop/enterprise/hardened-desktop/settings-management/configure-json-file.md).
Once the file is ready, collaborate with your MDM team to deploy your chosen
settings, along with your chosen method for [enforcing sign-in](/manuals/desktop/enterprise/enforce-sign-in/_index.md).
> [!IMPORTANT]
>
> Test this first with a small number of Docker Desktop developers to verify the functionality works as expected before deploying more widely.
### Manage your organizations
If you have more than one organization, consider either [consolidating them
into one organization](/manuals/accounts/organization/setup/orgs.md) or creating a
[Docker company](/manuals/accounts/company/_index.md) to manage multiple
organizations.
### Begin setup
#### Set up single sign-on and domain verification
Single sign-on (SSO) lets developers authenticate using their identity
providers (IdPs) to access Docker. SSO is available for a whole company and all associated organizations, or an individual organization that has a Docker
Business subscription. For more information, see the
[documentation](/manuals/security/authentication/single-sign-on/_index.md).
You can also enable [SCIM](/manuals/security/provisioning/scim/_index.md)
for further automation of provisioning and deprovisioning of users.
#### Set up Docker product entitlements included in the subscription
[Docker Build Cloud](/manuals/build-cloud/_index.md) significantly reduces
build times, both locally and in CI, by providing a dedicated remote builder
and shared cache. Powered by the cloud, developer time and local resources are
freed up so your team can focus on more important things, like innovation.
To get started, [set up a cloud builder](https://app.docker.com/build/).
[Docker Scout](manuals/scout/_index.md) is a solution for proactively enhancing
your software supply chain security. By analyzing your images, Docker Scout
compiles an inventory of components, also known as a Software Bill of Materials
(SBOM). The SBOM is matched against a continuously updated vulnerability
database to pinpoint security weaknesses. To get started, see
[Quickstart](/manuals/scout/quickstart.md).
[Testcontainers Cloud](https://testcontainers.com/cloud/docs/) allows
developers to run containers in the cloud, removing the need to run heavy
containers on your local machine.
[Docker Hardened Images](/manuals/dhi/_index.md) are minimal, secure, and production-ready container base and application images maintained by Docker.
Designed to reduce vulnerabilities and simplify compliance, DHIs integrate
easily into your existing Docker-based workflows with little to no retooling
required.
#### Ensure you're running a supported version of Docker Desktop
> [!WARNING]
>
> This step could affect the experience for users on older versions of Docker
> Desktop.
Existing users may be running outdated or unsupported versions of
Docker Desktop. All users should update to a supported version. Docker Desktop
versions released within the past 6 months from the latest release are supported.
Use an MDM solution to manage the version of Docker Desktop for users. Users
may also get Docker Desktop directly from Docker or through a company software
portal.
## Testing
### SSO and SCIM testing
Test SSO and SCIM by signing in to Docker Desktop or Docker Hub with the email
address linked to a Docker account that is part of the verified domain.
Developers who sign in using their Docker usernames remain unaffected by the
SSO and SCIM setup.
> [!IMPORTANT]
>
> Some users may need CLI based logins to Docker Hub, and for this they will
> need a [personal access token (PAT)](/manuals/security/access-tokens/personal-access-tokens.md).
### Test Registry Access Management and Image Access Management
> [!WARNING]
>
> Communicate with your users before proceeding, as this step will impact all
> existing users signing into your Docker organization.
If you plan to use [Registry Access Management (RAM)](/manuals/desktop/enterprise/hardened-desktop/registry-access-management.md) and/or [Image Access Management (IAM)](/manuals/desktop/enterprise/hardened-desktop/image-access-management.md):
1. Ensure your test developer signs in to Docker Desktop using their
organization credentials
2. Have them attempt to pull an unauthorized image or one from a disallowed
registry via the Docker CLI
3. Verify they receive an error message indicating that the registry is
restricted by the organization
### Deploy settings and enforce sign in to test group
Deploy the Docker settings and enforce sign-in for a small group of test users
via MDM. Have this group test their development workflows with containers on
Docker Desktop and Docker Hub to ensure all settings and the sign-in enforcement
function as expected.
### Test Docker Build Cloud capabilities
Have one of your Docker Desktop testers [connect to the cloud builder you created and use it to build](/manuals/build-cloud/usage.md).
### Test Testcontainers Cloud
Have a test developer [connect to Testcontainers Cloud](https://testcontainers.com/cloud/docs/#getting-started) and run a container in
the cloud to verify the setup is working correctly.
### Verify Docker Scout monitoring of repositories
Check the [Docker Scout dashboard](https://scout.docker.com/) to confirm that
data is being properly received for the repositories where Docker Scout has
been enabled.
### Verify access to Docker Hardened Images
Have a test developer attempt to [pull a Docker Hardened Image](/manuals/dhi/get-started.md) to confirm that
the team has proper access and can integrate these images into their workflows.
## Deploy your Docker setup
> [!WARNING]
>
> Communicate with your users before proceeding, and confirm that your IT and
> MDM teams are prepared to handle any unexpected issues, as these steps will
> affect all existing users signing into your Docker organization.
### Enforce SSO
Enforcing SSO means that anyone who has a Docker profile with an email address
that matches your verified domain must sign in using your SSO connection. Make
sure the Identity provider groups associated with your SSO connection cover all
the developer groups that you want to have access to the Docker subscription.
For instructions on how to enforce SSO, see [Enforce SSO](/manuals/security/authentication/single-sign-on/connect.md).
### Deploy configuration settings and enforce sign-in to users
Have the MDM team deploy the configuration files for Docker to all users.
### Next steps
Congratulations, you've successfully completed the admin implementation process
for Docker.
To continue optimizing your Docker environment:
- Review your [organization's usage data](/manuals/accounts/organization/insights.md) to track adoption
- Monitor [Docker Scout findings](/manuals/scout/explore/analysis.md) for security insights
- Explore [additional security features](/manuals/desktop/enterprise/hardened-desktop/_index.md) to enhance your configuration
content/guides/admin-user-management.md
-198
View File
@@ -1,198 +0,0 @@
---
title: Mastering user and access management
summary: Simplify user access while ensuring security and efficiency in Docker.
description: A guide for managing roles, provisioning users, and optimizing Docker access with tools like SSO and activity logs.
keywords: admin, user management, roles, permissions, sso, provisioning, access control
aliases:
- /guides/admin-user-management/audit-and-monitor/
- /guides/admin-user-management/onboard/
- /guides/admin-user-management/setup/
params:
tags: [admin]
featured: false
time: 20 minutes
image:
---
Managing roles and permissions is key to securing your Docker environment while enabling easy collaboration and operational efficiency. This guide walks IT administrators through the essentials of user and access management, offering strategies for assigning roles, provisioning users, and using tools like activity logs and Insights to monitor and optimize Docker usage.
## Who's this for?
- IT teams tasked with configuring and maintaining secure user access
- Security professionals focused on enforcing secure access practices
- Project managers overseeing team collaboration and resource management
## What you'll learn
- How to assess and manage Docker user access and align accounts with organizational needs
- When to use team configurations for scalable access control
- How to automate and streamline user provisioning with SSO, SCIM, and JIT
- How to get the most out of Docker's monitoring tools
## Tools integration
This guide covers integration with:
- Okta
- Entra ID SAML 2.0
- Azure Connect (OIDC)
## Setting up roles and permissions in Docker
With the right configurations, you can ensure your developers have easy access to necessary resources while preventing unauthorized access. This page guides you through identifying Docker users so you can allocate subscription seats efficiently within your Docker organization, and assigning roles to align with your organization's structure.
### Identify your Docker users and accounts
Before setting up roles and permissions, it's important to have a clear understanding of who in your organization requires Docker access. Focus on gathering a comprehensive view of active users, their roles within projects, and how they interact with Docker resources. This process can be supported by tools like device management software or manual assessments. Encourage all users to update their Docker accounts to use organizational email addresses, ensuring seamless integration with your subscription.
For steps on how you can do this, see [step 1 of onboarding your organization](/manuals/accounts/organization/setup/onboard.md).
### Assign roles strategically
When you invite members to join your Docker organization, you assign them a role.
Docker's predefined roles offer flexibility for various organizational needs. Assigning roles effectively ensures a balance of accessibility and security.
- Member: Non-administrative role. Members can view other members that are in the same organization.
- Editor: Partial administrative access to the organization. Editors can create, edit, and delete repositories. They can also edit an existing team's access permissions.
- Owner: Full organization administrative access. Owners can manage organization repositories, teams, members, settings, and billing.
For more information, see [Roles and permissions](/manuals/security/roles-and-permissions.md).
#### Enhance with teams
Teams in Docker provide a structured way to manage member access and they provide an additional level of permissions. They simplify permission management and enable consistent application of policies.
- Organize users into teams aligned with projects, departments, or functional roles. This approach helps streamline resource allocation and ensures clarity in access control.
- Assign permissions at the team level rather than individually. For instance, a development team might have "Read & Write" access to certain repositories, while a QA team has "Read-only" access.
- As teams grow or responsibilities shift, you can easily update permissions or add new members, maintaining consistency without reconfiguring individual settings.
For more information, see [Create and manage a team](/manuals/accounts/organization/manage/manage-a-team.md).
#### Example scenarios
- Development teams: Assign the member role to developers, granting access to the repositories needed for coding and testing.
- Team leads: Assign the editor role to team leads for resource management and repository control within their teams.
- Organizational oversight: Restrict the organization owner or company owner roles to a select few trusted individuals responsible for billing and security settings.
#### Best practices
- Apply the principle of least privilege. Assign users only the minimum permissions necessary for their roles.
- Conduct regular reviews of role assignments to ensure they align with evolving team structures and organizational responsibilities.
## Onboarding and managing roles and permissions in Docker
This page guides you through onboarding owners and members, and using tools like SSO and SCIM to future-proof onboarding going forward.
### Invite owners
When you create a Docker organization, you automatically become its sole owner. While optional, adding additional owners can significantly ease the process of onboarding and managing your organization by distributing administrative responsibilities. It also ensures continuity and prevents blockers if the primary owner is unavailable.
For detailed information on owners, see [Roles and permissions](/manuals/security/roles-and-permissions.md).
### Invite members and assign roles
Members are granted controlled access to resources and enjoy enhanced organizational benefits. When you invite members to join your Docker organization, you immediately assign them a role.
#### Benefits of inviting members
- Enhanced visibility: Gain insights into user activity, making it easier to monitor access and enforce security policies.
- Streamlined collaboration: Help members collaborate effectively by granting access to shared resources and repositories.
- Improved resource management: Organize and track users within your organization, ensuring optimal allocation of resources.
- Access to enhanced features: Members benefit from organization-wide perks, such as increased pull limits and access to premium Docker features.
- Security control: Apply and enforce security settings at an organizational level, reducing risks associated with unmanaged accounts.
For detailed information, see [Manage organization members](/manuals/accounts/organization/manage/members.md).
### Future-proof user management
A robust, future-proof approach to user management combines automated provisioning, centralized authentication, and dynamic access control. Implementing these practices ensures a scalable, secure, and efficient environment.
#### Secure user authentication with single sign-on (SSO)
Integrating Docker with your identity provider streamlines user access and enhances security.
SSO:
- Simplifies sign in, as users sign in with their organizational credentials.
- Reduces password-related vulnerabilities.
- Simplifies onboarding as it works seamlessly with SCIM and group mapping for automated provisioning.
For more information, see the [SSO documentation](/manuals/security/authentication/single-sign-on/_index.md).
#### Automate onboarding with SCIM and JIT provisioning
Streamline user provisioning and role management with [SCIM](/manuals/security/provisioning/scim/_index.md) and [Just-in-Time (JIT) provisioning](/manuals/security/provisioning/just-in-time.md).
With SCIM you can:
- Sync users and roles automatically with your identity provider.
- Automate adding, updating, or removing users based on directory changes.
With JIT provisioning you can:
- Automatically add users upon first sign in based on [group mapping](#simplify-access-with-group-mapping).
- Reduce overhead by eliminating pre-invite steps.
#### Simplify access with group mapping
Group mapping automates permissions management by linking identity provider groups to Docker roles and teams.
It also:
- Reduces manual errors in role assignments.
- Ensures consistent access control policies.
- Help you scale permissions as teams grow or change.
For more information on how it works, see [Group mapping](/manuals/security/provisioning/scim/group-mapping.md).
## Monitoring and insights
Activity logs and Insights are useful tools for user and access management in Docker. They provide visibility into user actions, team workflows, and organizational trends, helping enhance security, ensure compliance, and boost productivity.
### Activity logs
Activity logs track events at the organization and repository levels, offering a clear view of activities like repository changes, team updates, and billing adjustments.
Activity logs are available for Docker Team or Docker Business plans, with data retained for three months.
#### Key features
- Change tracking: View what changed, who made the change, and when.
- Comprehensive reporting: Monitor critical events such as repository creation, deletion, privacy changes, and role assignments.
#### Example scenarios
- Audit trail for security: A repository’s privacy settings were updated unexpectedly. The activity logs reveal which user made the change and when, helping administrators address potential security risks.
- Team collaboration review: Logs show which team members pushed updates to a critical repository, ensuring accountability during a development sprint.
- Billing adjustments: Track who added or removed subscription seats to maintain budgetary control and compliance.
For more information, see [Activity logs](/manuals/accounts/organization/activity-logs.md).
### Insights
Insights provide data-driven views of Docker usage to improve team productivity and resource allocation.
#### Key benefits
- Standardized environments: Ensure consistent configurations and enforce best practices across teams.
- Improved visibility: Monitor metrics like Docker Desktop usage, builds, and container activity to understand team workflows and engagement.
- Optimized resources: Track license usage and feature adoption to maximize the value of your Docker subscription.
#### Example scenarios
- Usage trends: Identify underutilized licenses or resources, allowing reallocation to more active teams.
- Build efficiency: Track average build times and success rates to pinpoint bottlenecks in development processes.
- Container utilization: Analyze container activity across departments to ensure proper resource distribution and cost efficiency.
For more information, see [Insights](/manuals/accounts/organization/insights.md).
### Next steps
Now that you've mastered user and access management in Docker, you can:
- Review your [activity logs](/manuals/accounts/organization/activity-logs.md) regularly to maintain security awareness
- Check your [Insights dashboard](/manuals/accounts/organization/insights.md) to identify opportunities for optimization
- Explore [advanced security features](/manuals/desktop/enterprise/hardened-desktop/_index.md) to further enhance your Docker environment
- Share best practices with your team to ensure consistent adoption of security policies
content/manuals/accounts/organization/_index.md
+5
View File
@@ -84,6 +84,11 @@ access to many people at once. Use a team when several members need the
same repositories. Members can belong to the organization without joining
a team.
For a deployment across your organization, start with
[Plan and roll out Docker](/manuals/accounts/organization/setup/rollout.md).
For ongoing membership and permissions decisions, use
[Plan and maintain user access](/manuals/accounts/organization/manage/user-access.md).
## Next steps
Learn how to manage organizations in the following sections.
content/manuals/accounts/organization/manage/_index.md
+4
View File
@@ -5,6 +5,10 @@ weight: 20
description: Learn how to manage your Docker organization, including members, teams, licenses, seats, product access, and settings.
keywords: manage organization, members, teams, licenses, seats, product access, organization management, docker home, organization settings, deactivate organization
grid:
- title: User access workflow
description: Plan roles, provisioning, and ongoing access reviews.
icon: user-group
link: /accounts/organization/manage/user-access/
- title: Information
description: Update your organization's general information and settings.
icon: pencil-square
content/manuals/accounts/organization/manage/user-access.md
+130
View File
@@ -0,0 +1,130 @@
---
title: Plan and maintain user access
linkTitle: User access workflow
weight: 15
description: Identify Docker users, choose roles and provisioning methods, and review access and adoption across your organization.
keywords: admin, user management, roles, permissions, SSO, provisioning, access control
aliases:
- /guides/admin-user-management/
- /guides/admin-user-management/audit-and-monitor/
- /guides/admin-user-management/onboard/
- /guides/admin-user-management/setup/
---
Use this workflow to decide who needs access to your Docker organization,
assign appropriate permissions, and keep membership aligned with changing
responsibilities. It links to the procedures for onboarding, provisioning,
and monitoring so you can apply those decisions.
## Setting up roles and permissions in Docker
### Identify your Docker users and accounts
Inventory the people who need Docker access, the projects they work on, and
the resources they need. Use device management records or ask development
teams to identify existing Docker Desktop users. Ask users to use their
business email for their Docker accounts.
Follow [organization onboarding](/manuals/accounts/organization/setup/onboard.md)
for the identification procedure and seat planning. Keep this inventory as
the starting point for access reviews.
### Assign roles strategically
Choose the minimum permissions each person needs. Compare the built-in
Member, Editor, and Owner roles with
[Roles and permissions](/manuals/security/roles-and-permissions/_index.md).
If you need a combination of permissions that the built-in roles don't
provide, consider custom roles, which require Docker Business.
#### Enhance with teams
Group members by project, department, or shared repository needs. A member's
role determines organization-wide access, while team permissions apply to
specific repositories. Avoid granting an administrative role solely because
a developer needs access to a project's repositories.
Use [Create and manage a team](/manuals/accounts/organization/manage/manage-a-team.md)
to apply repository permissions to groups of members. Review team membership
when projects or responsibilities change.
## Onboarding and managing roles and permissions in Docker
### Invite owners
Decide who needs to administer membership, settings, and billing. Additional
owners can share these responsibilities and provide continuity when another
owner is unavailable. Review the permissions before assigning the role.
### Invite members and assign roles
Use your access inventory to assign roles and teams. Follow
[Onboard a Docker organization](/manuals/accounts/organization/setup/onboard.md)
for initial setup and
[Manage organization members](/manuals/accounts/organization/manage/members.md)
for invitations and membership changes.
### Choose a provisioning method {#future-proof-user-management}
Decide who will maintain membership as people join, move between teams, or
leave. Manual invitations can suit a small organization. For Docker Business
organizations using an identity provider, compare the
[provisioning methods](/manuals/security/provisioning/_index.md) before
choosing how to automate membership.
#### Secure user authentication with single sign-on (SSO)
[SSO](/manuals/security/authentication/single-sign-on/_index.md) authenticates
users through your identity provider. Plan it together with provisioning,
which controls account creation, updates, and removal.
#### Automate onboarding with SCIM and JIT provisioning
Choose a method based on the user lifecycle you need to manage:
- [Just-in-Time (JIT) provisioning](/manuals/security/provisioning/just-in-time.md)
creates and updates accounts during SSO sign-in. It doesn't deprovision users,
so plan how to remove access when users leave.
- [SCIM](/manuals/security/provisioning/scim/_index.md) synchronizes users
with your identity provider and supports deprovisioning. If you enable SCIM,
choose how it will work with JIT so the intended source manages user attributes.
Test adding a user, changing their team, and removing access before relying
on automated provisioning for the whole organization.
#### Simplify access with group mapping
Use [group mapping](/manuals/security/provisioning/scim/group-mapping.md)
to assign identity provider groups to Docker organizations and teams.
Group mapping works with SAML SSO or SCIM. For Microsoft Entra ID OIDC
connections, use SCIM to synchronize groups. Review the mappings when your
identity provider groups change.
## Monitoring and insights
Schedule access reviews with organization owners and team leads. Compare
membership with your access inventory, remove users who no longer need
access, and adjust roles and teams when responsibilities change.
### Activity logs
Use [activity logs](/manuals/accounts/organization/activity-logs.md) to review
organization and repository changes, including repository privacy changes
and subscription seat changes. Check who made an unexpected change and when
it happened. Docker Home retains logs for 90 days; plan exports if your audit
process needs a longer history.
### Insights
If your organization meets the subscription and configuration requirements,
use [Insights](/manuals/accounts/organization/insights.md) to review Docker
Desktop adoption, versions, builds, and container usage. Active user counts
include only users who send analytics. Compare usage with your membership
inventory before deciding whether to change access or subscription seats.
### Next steps
- Review [members](/manuals/accounts/organization/manage/members.md) and
[teams](/manuals/accounts/organization/manage/manage-a-team.md) on a regular schedule.
- Use [rollout planning](/manuals/accounts/organization/setup/rollout.md)
before deploying changes to Docker Desktop settings or sign-in requirements.
content/manuals/accounts/organization/setup/_index.md
+4
View File
@@ -13,6 +13,10 @@ keywords:
- organization namespace
- Docker Home
grid:
- title: Plan your rollout
description: Coordinate settings, pilot testing, and deployment.
icon: magnifying-glass-plus
link: /accounts/organization/setup/rollout/
- title: Create your organization
description: Choose a new namespace and subscription.
icon: building-storefront
content/manuals/accounts/organization/setup/onboard.md
+3
View File
@@ -170,6 +170,9 @@ Use these features to manage your organization's security posture:
## Next steps
- [Plan your rollout](/manuals/accounts/organization/setup/rollout.md) to
coordinate pilot testing and deployment with your IT teams.
- [Manage Docker products](../manage/manage-products.md) to configure
access and view usage.
- Configure
content/manuals/accounts/organization/setup/rollout.md
+158
View File
@@ -0,0 +1,158 @@
---
title: Plan and roll out Docker
linkTitle: Plan your rollout
weight: 40
description: Coordinate stakeholders, define Docker Desktop settings, test with a pilot group, and roll out Docker across your organization.
keywords: admin, onboarding, deployment, organization setup, Docker Desktop, rollout
aliases:
- /guides/admin-set-up/
- /guides/admin-set-up/comms-and-info-gathering/
- /guides/admin-set-up/deploy/
- /guides/admin-set-up/finalize-plans-and-setup/
- /guides/admin-set-up/testing/
---
Use this workflow to plan a Docker rollout across your organization, test its
settings with a pilot group, and coordinate deployment with your IT teams.
For invitations and sign-in configuration, follow
[Onboard a Docker organization](/manuals/accounts/organization/setup/onboard.md).
## Who needs to be involved
Identify the people responsible for each part of the rollout:
- Organization owners to manage membership and organization settings
- DNS and identity provider teams to verify domains and configure single sign-on (SSO)
- IT and mobile device management (MDM) teams to distribute Docker Desktop and configuration files
- Development leads and security representatives to agree on settings and security requirements
- A small group of developers to test the configuration before wider deployment
## Communication and information gathering
### Communicate with your developers and IT teams
Notify existing Docker Desktop users before changing versions, settings, or
sign-in requirements. Explain which changes they should expect, when the pilot
and wider rollout will happen, and where to report problems. Ask users to use
their business email for their Docker accounts.
Engage your MDM team early to understand deployment requirements and lead
times. Agree on how to distribute configuration files, registry keys, or
`.plist` files for your chosen deployment method.
### Identify Docker organizations
Survey teams to find existing Docker organizations and decide which ones
should be part of the rollout. If you need to administer multiple
organizations together, consider a
[Docker company](/manuals/accounts/company/_index.md). A company groups Docker
organizations; it is separate from the business deploying Docker Desktop.
### Gather requirements
Work with organization owners, development leads, and security representatives
to define a baseline that supports development workflows and company policies.
Agree on:
- Docker Desktop versions and update policies
- Settings developers can change and settings administrators must control
- Sign-in requirements, identity provider integration, and user provisioning
- Approved image sources and registries
- Additional Docker products your teams need and the subscriptions they require
Review [Settings Management](/manuals/desktop/enterprise/hardened-desktop/settings-management/_index.md)
and [Hardened Docker Desktop](/manuals/desktop/enterprise/hardened-desktop/_index.md)
to choose controls available with your subscription.
## Finalize plans and begin setup
### Send finalized settings files to the MDM team
Record the agreed baseline and configure it through
[Docker Home](/manuals/desktop/enterprise/hardened-desktop/settings-management/configure-admin-console.md)
or an [`admin-settings.json` file](/manuals/desktop/enterprise/hardened-desktop/settings-management/configure-json-file.md),
as appropriate for your subscription and deployment method. Coordinate with
your MDM team to prepare the configuration and your chosen method for
[enforcing sign-in](/manuals/desktop/enterprise/enforce-sign-in/_index.md).
Deploy to the pilot group before applying the settings more widely.
### Begin setup
Follow [organization onboarding](/manuals/accounts/organization/setup/onboard.md)
to identify users, invite owners and members, and configure sign-in and
provisioning. SSO and SCIM require Docker Business. Plan authentication and
provisioning together: SSO authenticates users, while provisioning controls
how users are added, updated, and removed.
Choose a supported Docker Desktop version and agree with IT on how users will
receive it through MDM, a software portal, or direct installation. See
[Docker Desktop deployment](/manuals/desktop/enterprise/enterprise-deployment.md).
If your rollout includes other Docker products, confirm access and complete
their setup before the pilot. For example, follow the setup documentation for
[Docker Build Cloud](/manuals/build-cloud/setup/_index.md),
[Docker Scout](/manuals/scout/quickstart.md), or
[Docker Hardened Images](/manuals/dhi/get-started.md).
## Testing
### SSO and SCIM testing
If you configure SSO or SCIM, test sign-in, provisioning, role assignments,
and team membership with pilot accounts. Include a user joining the
organization and a user leaving it. Follow the
[provisioning documentation](/manuals/security/provisioning/_index.md)
for the behavior of your chosen method. Check CLI authentication as well as
Docker Desktop and browser sign-in.
### Test Registry Access Management and Image Access Management
If your subscription and rollout include
[Registry Access Management](/manuals/desktop/enterprise/hardened-desktop/registry-access-management.md)
or [Image Access Management](/manuals/desktop/enterprise/hardened-desktop/image-access-management.md),
verify that pilot users can pull approved images and that configured
restrictions block disallowed sources. Tell pilot users about these
restrictions before testing them.
### Deploy settings and enforce sign in to test group
Apply the baseline settings and sign-in requirements to the pilot group.
Have developers run their normal projects on Docker Desktop and Docker Hub.
Confirm that required settings apply and that developers can still build,
pull, and run the containers they need. Use the
[pilot rollout tutorial](/get-started/tutorials/admin-set-up.md) for a focused
settings policy test.
For each additional product in your rollout, have a pilot developer complete
a representative task: build with a cloud builder, review Scout results, or
pull a Hardened Image. Record problems and adjust the baseline before wider
deployment.
## Deploy your Docker setup
Communicate the rollout schedule and expected changes to users. Confirm that
IT and MDM teams are ready to distribute the tested configuration and support
users who encounter problems.
### Enforce SSO
If your plan includes SSO enforcement, verify that your identity provider
configuration covers all intended users before enforcing it. Follow
[Configure SSO](/manuals/security/authentication/single-sign-on/connect.md)
for setup and enforcement. Enforcing SSO and enforcing Docker Desktop sign-in
are separate controls.
### Deploy configuration settings and enforce sign-in to users
Have the MDM team distribute the tested Docker configuration to the remaining
users. Provide instructions for sign-in and a support contact. Review feedback
after each deployment group before expanding the rollout.
### Next steps
- Review [organization Insights](/manuals/accounts/organization/insights.md),
if available for your subscription, to track Docker Desktop adoption and versions.
- Use the [user access workflow](/manuals/accounts/organization/manage/user-access.md)
to review membership and permissions after rollout.
- Monitor [Docker Scout findings](/manuals/scout/explore/analysis.md) for
repositories where you've configured Scout.