Image Access Management
Note
Image Access Management is available to Docker Business customers only.
Image Access Management gives you control over which types of images, such as Docker Official Images, Docker Verified Publisher Images, or community images, your developers can pull from Docker Hub.
For example, a developer, who is part of an organization, building a new containerized application could accidentally use an untrusted, community image as a component of their application. This image could be malicious and pose a security risk to the company. Using Image Access Management, the organization owner can ensure that the developer can only access trusted content like Docker Official Images, Docker Verified Publisher Images, or the organization’s own images, preventing such a risk.
Prerequisites
You first need to enforce sign-in to ensure that all Docker Desktop developers authenticate with your organization. Since Image Access Management requires a Docker Business subscription, enforced sign-in guarantees that only authenticated users have access and that the feature consistently takes effect across all users, even though it may still work without enforced sign-in.
Configure
- Sign in to Docker Hub.
- Select Organizations, your organization, Settings, and then select Image Access.
- Enable Image Access Management to set the permissions for the following categories of images you can manage:
- Organization Images: Images from your organization are always allowed by default. These images can be public or private created by members within your organization.
- Docker Official Images: A curated set of Docker repositories hosted on Hub. They provide OS repositories, best practices for Dockerfiles, drop-in solutions, and applies security updates on time.
- Docker Verified Publisher Images: Images published by Docker partners that are part of the Verified Publisher program and are qualified to be included in the developer secure supply chain.
- Community Images: These images are disabled by default when Image Access Management is enabled because various users contribute them and they may pose security risks. This category includes Docker-Sponsored Open Source images.
Note
Image Access Management is turned off by default. However, owners in your organization have access to all images regardless of the settings.
- Select the category restrictions for your images by selecting Allowed. Once the restrictions are applied, your members can view the organization permissions page in a read-only format.
Verify the restrictions
The new Image Access Management policy takes effect after the developer successfully authenticates to Docker Desktop using their organization credentials. If a developer attempts to pull a disallowed image type using Docker, they receive an error message.
Early Access
The Docker Admin Console is an early access product.
It's available to all company owners and organization owners. You can still manage organizations in Docker Hub, but the Admin Console includes company-level management and enhanced features for organization management.
- Sign in to the Admin Console.
- Select your organization in the left navigation drop-down menu, and then select Image access.
- Enable Image Access Management to set the permissions for the following categories of images you can manage:
- Organization Images: Images from your organization are always allowed by default. These images can be public or private created by members within your organization.
- Docker Official Images: A curated set of Docker repositories hosted on Hub. They provide OS repositories, best practices for Dockerfiles, drop-in solutions, and applies security updates on time.
- Docker Verified Publisher Images: Images published by Docker partners that are part of the Verified Publisher program and are qualified to be included in the developer secure supply chain.
- Community Images: These images are disabled by default when Image Access Management is enabled because various users contribute them and they may pose security risks. This category includes Docker-Sponsored Open Source images.
Note
Image Access Management is turned off by default. However, owners in your organization have access to all images regardless of the settings.
- Select the category restrictions for your images by selecting Allowed. Once the restrictions are applied, your members can view the organization permissions page in a read-only format.
Verify the restrictions
The new Image Access Management policy takes effect after the developer successfully authenticates to Docker Desktop using their organization credentials. If a developer attempts to pull a disallowed image type using Docker, they receive an error message.