diff --git a/_data/glossary.yaml b/_data/glossary.yaml
index 0119bc7213..98c9555360 100644
--- a/_data/glossary.yaml
+++ b/_data/glossary.yaml
@@ -71,14 +71,14 @@ Docker: |
- The docker daemon process running on the host which manages images and containers
(also called Docker Engine)
Docker Desktop for Mac: |
- [Docker Desktop for Mac](/docker-for-mac/) is an easy-to-install, lightweight
+ [Docker Desktop for Mac](/desktop/mac/) is an easy-to-install, lightweight
Docker development environment designed specifically for the Mac. A native
Mac application, Docker Desktop for Mac uses the macOS Hypervisor
framework, networking, and filesystem. It's the best solution if you want
to build, debug, test, package, and ship Dockerized applications on a
Mac.
Docker Desktop for Windows: |
- [Docker Desktop for Windows](/docker-for-windows/) is an
+ [Docker Desktop for Windows](/desktop/windows/) is an
easy-to-install, lightweight Docker development environment designed
specifically for Windows 10 systems that support Microsoft Hyper-V
(Professional, Enterprise and Education). Docker Desktop for Windows uses Hyper-V for
diff --git a/_data/redirects.csv b/_data/redirects.csv
index 3d6af48cf6..6ef7559272 100644
--- a/_data/redirects.csv
+++ b/_data/redirects.csv
@@ -1,8 +1,8 @@
source,destination
/engine/quickstart/,/get-started/
/engine/containers/,/engine/tutorials/
-/win/,/docker-for-windows/
-/mac/,/docker-for-mac/
+/win/,/desktop/windows/
+/mac/,/desktop/mac/
/linux/,/engine/
/article-img/,/engine/article-img/
/articles/,/engine/articles/
diff --git a/_data/toc.yaml b/_data/toc.yaml
index bc80072f32..7d5c44e383 100644
--- a/_data/toc.yaml
+++ b/_data/toc.yaml
@@ -1186,37 +1186,37 @@ manuals:
title: Overview
- sectiontitle: Mac
section:
- - path: /docker-for-mac/install/
+ - path: /desktop/mac/install/
title: Install Docker Desktop for Mac
- - path: /docker-for-mac/
+ - path: /desktop/mac/
title: User manual
- - path: /docker-for-mac/networking/
+ - path: /desktop/mac/networking/
title: Networking
- - path: /docker-for-mac/space/
+ - path: /desktop/mac/space/
title: Disk utilization
- - path: /docker-for-mac/troubleshoot/
+ - path: /desktop/mac/troubleshoot/
title: Logs and troubleshooting
- - path: /docker-for-mac/apple-silicon/
+ - path: /desktop/mac/apple-silicon/
title: Apple silicon
- - path: /docker-for-mac/release-notes/
+ - path: /desktop/mac/release-notes/
title: Release notes
- - path: /docker-for-mac/previous-versions/
+ - path: /desktop/mac/previous-versions/
title: Previous versions
- sectiontitle: Windows
section:
- - path: /docker-for-windows/install/
+ - path: /desktop/windows/install/
title: Install Docker Desktop for Windows
- - path: /docker-for-windows/
+ - path: /desktop/windows/
title: User manual
- - path: /docker-for-windows/networking/
+ - path: /desktop/windows/networking/
title: Networking
- - path: /docker-for-windows/troubleshoot/
+ - path: /desktop/windows/troubleshoot/
title: Logs and troubleshooting
- - path: /docker-for-windows/wsl/
+ - path: /desktop/windows/wsl/
title: Docker Desktop WSL 2 backend
- - path: /docker-for-windows/release-notes/
+ - path: /desktop/windows/release-notes/
title: Release notes
- - path: /docker-for-windows/previous-versions/
+ - path: /desktop/windows/previous-versions/
title: Previous versions
- path: /desktop/dashboard/
title: Dashboard
diff --git a/_includes/content/compose-var-sub.md b/_includes/content/compose-var-sub.md
index 2628e7eef1..2859687fb8 100644
--- a/_includes/content/compose-var-sub.md
+++ b/_includes/content/compose-var-sub.md
@@ -61,6 +61,6 @@ web:
If you forget and use a single dollar sign (`$`), Compose interprets the value
as an environment variable and warns you:
-```
+```console
The VAR_NOT_INTERPOLATED_BY_COMPOSE is not set. Substituting an empty string.
```
diff --git a/_includes/desktop-update.md b/_includes/desktop-update.md
index 526fa7b7b9..2bd1419002 100644
--- a/_includes/desktop-update.md
+++ b/_includes/desktop-update.md
@@ -4,6 +4,6 @@ Starting with Docker Desktop 3.0.0, updates to Docker Desktop will be available
> To encourage developers to stay up to date, Docker Desktop displays a reminder two weeks after an update becomes available. You can dismiss this daily reminder by clicking **Snooze**. You can skip an update when a reminder appears by clicking the **Skip this update** option.
-{:width="500px"}
+{:width="500px"}
Click **Download update** When you are ready to download the update. This downloads the update in the background. After downloading the update, click **Update and restart** from the Docker menu. This installs the latest update and restarts Docker Desktop for the changes to take effect.
diff --git a/_includes/enable-buildkit.md b/_includes/enable-buildkit.md
index aee2624039..c69911e86c 100644
--- a/_includes/enable-buildkit.md
+++ b/_includes/enable-buildkit.md
@@ -14,7 +14,7 @@ variable or by making BuildKit the default setting.
To set the BuildKit environment variable when running the `docker build` command,
run:
-```
+```console
$ DOCKER_BUILDKIT=1 docker build .
```
diff --git a/_layouts/landing.html b/_layouts/landing.html
index 348651f96b..3cc57465ad 100644
--- a/_layouts/landing.html
+++ b/_layouts/landing.html
@@ -204,7 +204,7 @@
diff --git a/cloud/aci-integration.md b/cloud/aci-integration.md
index bb5566bfea..7de4dbf394 100644
--- a/cloud/aci-integration.md
+++ b/cloud/aci-integration.md
@@ -26,8 +26,8 @@ To deploy Docker containers on Azure, you must meet the following requirements:
1. Download and install the latest version of Docker Desktop.
- - [Download for Mac](../docker-for-mac/install.md)
- - [Download for Windows](../docker-for-windows/install.md)
+ - [Download for Mac](../desktop/mac/install.md)
+ - [Download for Windows](../desktop/windows/install.md)
Alternatively, install the [Docker Compose CLI for Linux](#install-the-docker-compose-cli-on-linux).
diff --git a/cloud/ecs-integration.md b/cloud/ecs-integration.md
index 1a06c6a7fd..c9c0960aa0 100644
--- a/cloud/ecs-integration.md
+++ b/cloud/ecs-integration.md
@@ -25,8 +25,8 @@ To deploy Docker containers on ECS, you must meet the following requirements:
1. Download and install the latest version of Docker Desktop.
- - [Download for Mac](../docker-for-mac/install.md)
- - [Download for Windows](../docker-for-windows/install.md)
+ - [Download for Mac](../desktop/mac/install.md)
+ - [Download for Windows](../desktop/windows/install.md)
Alternatively, install the [Docker Compose CLI for Linux](#install-the-docker-compose-cli-on-linux).
@@ -522,35 +522,37 @@ use an existing domain name for your application:
1. Use the AWS web console or CLI to get your VPC and Subnets IDs. You can retrieve the default VPC ID and attached subnets using this AWS CLI commands:
-```console
-$ aws ec2 describe-vpcs --filters Name=isDefault,Values=true --query 'Vpcs[0].VpcId'
+ ```console
+ $ aws ec2 describe-vpcs --filters Name=isDefault,Values=true --query 'Vpcs[0].VpcId'
+
+ "vpc-123456"
+ $ aws ec2 describe-subnets --filters Name=vpc-id,Values=vpc-123456 --query 'Subnets[*].SubnetId'
+
+ [
+ "subnet-1234abcd",
+ "subnet-6789ef00",
+ ]
+ ```
+
+2. Use the AWS CLI to create your load balancer. The AWS Web Console can also be used but will require adding at least one listener, which we don't need here.
-"vpc-123456"
-$ aws ec2 describe-subnets --filters Name=vpc-id,Values=vpc-123456 --query 'Subnets[*].SubnetId'
-
-[
- "subnet-1234abcd",
- "subnet-6789ef00",
-]
-```
-1. Use the AWS CLI to create your load balancer. The AWS Web Console can also be used but will require adding at least one listener, which we don't need here.
-
-```console
-$ aws elbv2 create-load-balancer --name myloadbalancer --type application --subnets "subnet-1234abcd" "subnet-6789ef00"
-
-{
- "LoadBalancers": [
+ ```console
+ $ aws elbv2 create-load-balancer --name myloadbalancer --type application --subnets "subnet-1234abcd" "subnet-6789ef00"
+
{
- "IpAddressType": "ipv4",
- "VpcId": "vpc-123456",
- "LoadBalancerArn": "arn:aws:elasticloadbalancing:us-east-1:1234567890:loadbalancer/app/myloadbalancer/123abcd456",
- "DNSName": "myloadbalancer-123456.us-east-1.elb.amazonaws.com",
-...
-```
-1. To assign your application an existing domain name, you can configure your DNS with a
-CNAME entry pointing to just-created loadbalancer's `DNSName` reported as you created the loadbalancer.
+ "LoadBalancers": [
+ {
+ "IpAddressType": "ipv4",
+ "VpcId": "vpc-123456",
+ "LoadBalancerArn": "arn:aws:elasticloadbalancing:us-east-1:1234567890:loadbalancer/app/myloadbalancer/123abcd456",
+ "DNSName": "myloadbalancer-123456.us-east-1.elb.amazonaws.com",
+ <...>
+ ```
+
+3. To assign your application an existing domain name, you can configure your DNS with a
+ CNAME entry pointing to just-created loadbalancer's `DNSName` reported as you created the loadbalancer.
-1. Use Loadbalancer ARN to set `x-aws-loadbalancer` in your compose file, and deploy your application using `docker compose up` command.
+4. Use Loadbalancer ARN to set `x-aws-loadbalancer` in your compose file, and deploy your application using `docker compose up` command.
Please note Docker ECS integration won't be aware of this domain name, so `docker compose ps` command will report URLs with loadbalancer DNSName, not your own domain.
diff --git a/components.md b/components.md
index 36d0990983..355684ac34 100644
--- a/components.md
+++ b/components.md
@@ -29,6 +29,7 @@ For components and controls we are using [Bootstrap](https://getbootstrap.com)
```
+
diff --git a/engine/breaking_changes.md b/engine/breaking_changes.md
index 570ac6d994..eb57e37613 100644
--- a/engine/breaking_changes.md
+++ b/engine/breaking_changes.md
@@ -10,15 +10,15 @@ Every Engine release strives to be backward compatible with its predecessors,
and interface stability is always a priority at Docker.
In all cases, feature removal is communicated three releases
-in advance and documented as part of the [deprecated features](deprecated.md)
+in advance and documented as part of the [deprecated features](/engine/deprecated/)
page.
The following list compiles any updates to Docker Engine that created
backwards-incompatibility for old versions of Docker tools.
> **Note**: In the case of your local environment, you should be updating your
- Docker Engine using [Docker Desktop for Mac](/docker-for-mac),
- [Docker Desktop for Windows](/docker-for-windows). That way all your tools stay
+ Docker Engine using [Docker Desktop for Mac](../desktop/mac/index.md),
+ [Docker Desktop for Windows](../desktop/windows/index.md). That way all your tools stay
in sync with Docker Engine.
## Engine 1.10
diff --git a/engine/context/working-with-contexts.md b/engine/context/working-with-contexts.md
index 65d17f59ff..d986a1ad9f 100644
--- a/engine/context/working-with-contexts.md
+++ b/engine/context/working-with-contexts.md
@@ -40,7 +40,7 @@ A context is a combination of several properties. These include:
The easiest way to see what a context looks like is to view the **default** context.
-```
+```console
$ docker context ls
NAME DESCRIPTION DOCKER ENDPOINT KUBERNETES ENDPOINT ORCHESTRATOR
default * Current... unix:///var/run/docker.sock swarm
@@ -52,7 +52,7 @@ The asterisk in the `NAME` column indicates that this is the active context. Thi
Dig a bit deeper with `docker context inspect`. In this example, we're inspecting the context called `default`.
-```
+```console
$ docker context inspect default
[
{
@@ -86,7 +86,7 @@ The following example creates a new context called "docker-test" and specifies t
- Default orchestrator = Swarm
- Issue commands to the local Unix socket `/var/run/docker.sock`
-```
+```console
$ docker context create docker-test \
--default-stack-orchestrator=swarm \
--docker host=unix:///var/run/docker.sock
@@ -102,7 +102,7 @@ You can view the new context with `docker context ls` and `docker context inspec
The following can be used to create a config with Kubernetes as the default orchestrator using the existing kubeconfig stored in `/home/ubuntu/.kube/config`. For this to work, you will need a valid kubeconfig file in `/home/ubuntu/.kube/config`. If your kubeconfig has more than one context, the current context (`kubectl config current-context`) will be used.
-```
+```console
$ docker context create k8s-test \
--default-stack-orchestrator=kubernetes \
--kubernetes config-file=/home/ubuntu/.kube/config \
@@ -113,7 +113,7 @@ Successfully created context "k8s-test"
You can view all contexts on the system with `docker context ls`.
-```
+```console
$ docker context ls
NAME DESCRIPTION DOCKER ENDPOINT KUBERNETES ENDPOINT ORCHESTRATOR
default * Current unix:///var/run/docker.sock https://35.226.99.100 (default) swarm
@@ -129,7 +129,7 @@ You can use `docker context use` to quickly switch between contexts.
The following command will switch the `docker` CLI to use the "k8s-test" context.
-```
+```console
$ docker context use k8s-test
k8s-test
@@ -138,7 +138,7 @@ Current context is now "k8s-test"
Verify the operation by listing all contexts and ensuring the asterisk ("\*") is against the "k8s-test" context.
-```
+```console
$ docker context ls
NAME DESCRIPTION DOCKER ENDPOINT KUBERNETES ENDPOINT ORCHESTRATOR
default Current DOCKER_HOST based configuration unix:///var/run/docker.sock https://35.226.99.100 (default) swarm
@@ -154,13 +154,13 @@ Use the appropriate command below to set the context to `docker-test` using an e
Windows PowerShell:
-```
+```console
> $Env:DOCKER_CONTEXT=docker-test
```
Linux:
-```
+```console
$ export DOCKER_CONTEXT=docker-test
```
@@ -168,7 +168,7 @@ Run a `docker context ls` to verify that the "docker-test" context is now the ac
You can also use the global `--context` flag to override the context specified by the `DOCKER_CONTEXT` environment variable. For example, the following will send the command to a context called "production".
-```
+```console
$ docker --context production container ls
```
@@ -188,21 +188,21 @@ Let's look at exporting and importing a native Docker context.
The following example exports an existing context called "docker-test". It will be written to a file called `docker-test.dockercontext`.
-```
+```console
$ docker context export docker-test
Written file "docker-test.dockercontext"
```
Check the contents of the export file.
-```
+```console
$ cat docker-test.dockercontext
meta.json0000644000000000000000000000022300000000000011023 0ustar0000000000000000{"Name":"docker-test","Metadata":{"StackOrchestrator":"swarm"},"Endpoints":{"docker":{"Host":"unix:///var/run/docker.sock","SkipTLSVerify":false}}}tls0000700000000000000000000000000000000000000007716 5ustar0000000000000000
```
This file can be imported on another host using `docker context import`. The target host must have the Docker client installed.
-```
+```console
$ docker context import docker-test docker-test.dockercontext
docker-test
Successfully imported context "docker-test"
@@ -220,14 +220,14 @@ You can export a Kubernetes context only if the context you are exporting has a
These steps will use the `--kubeconfig` flag to export **only** the Kubernetes elements of the existing `k8s-test` context to a file called "k8s-test.kubeconfig". The `cat` command will then show that it's exported as a valid kubeconfig file.
-```
+```console
$ docker context export k8s-test --kubeconfig
Written file "k8s-test.kubeconfig"
```
Verify that the exported file contains a valid kubectl config.
-```
+```console
$ cat k8s-test.kubeconfig
apiVersion: v1
clusters:
@@ -265,7 +265,7 @@ You can use `docker context update` to update fields in an existing context.
The following example updates the "Description" field in the existing `k8s-test` context.
-```
+```console
$ docker context update k8s-test --description "Test Kubernetes cluster"
k8s-test
Successfully updated context "k8s-test"
diff --git a/engine/install/index.md b/engine/install/index.md
index 704af3b3d4..339e20aa27 100644
--- a/engine/install/index.md
+++ b/engine/install/index.md
@@ -32,7 +32,7 @@ redirect_from:
## Supported platforms
Docker Engine is available on a variety of [Linux platforms](#server),
-[macOS](../../docker-for-mac/install.md) and [Windows 10](../../docker-for-windows/install.md)
+[macOS](../../desktop/mac/install.md) and [Windows 10](../../desktop/windows/install.md)
through Docker Desktop, and as a [static binary installation](binaries.md). Find
your preferred operating system below.
@@ -42,8 +42,8 @@ your preferred operating system below.
| Platform | x86_64 / amd64 | arm64 (Apple Silicon) |
|:------------------------------------------------------------------|:------------------------------------------------:|:------------------------------------------------:|
-| [Docker Desktop for Mac (macOS)](../../docker-for-mac/install.md) | [{{ yes }}](../../docker-for-mac/install.md) | [{{ yes }}](../../docker-for-mac/install.md) |
-| [Docker Desktop for Windows](../../docker-for-windows/install.md) | [{{ yes }}](../../docker-for-windows/install.md) | |
+| [Docker Desktop for Mac (macOS)](../../desktop/mac/install.md) | [{{ yes }}](../../desktop/mac/install.md) | [{{ yes }}](../../desktop/mac/install.md) |
+| [Docker Desktop for Windows](../../desktop/windows/install.md) | [{{ yes }}](../../desktop/windows/install.md) | |
### Server
diff --git a/engine/reference/commandline/app.md b/engine/reference/commandline/app.md
index 79d12adaf6..a39dc7a35c 100644
--- a/engine/reference/commandline/app.md
+++ b/engine/reference/commandline/app.md
@@ -68,7 +68,7 @@ it initializes a new project based on the Compose file.
Use the following command to initialize a new empty project called "hello-world".
-```
+```console
$ docker app init hello-world
Created "hello-world.dockerapp"
```
@@ -82,7 +82,7 @@ project with `.dockerapp` appended, and the three YAML files are:
Inspect the YAML files with the following commands.
-```
+```console
$ cd hello-world.dockerapp/
$ cat docker-compose.yml
@@ -116,19 +116,19 @@ This section describes editing the project YAML files so that it runs a simple w
Use your preferred editor to edit the `docker-compose.yml` YAML file and update it with
the following information:
-```
+```yaml
version: "3.6"
services:
hello:
image: hashicorp/http-echo
command: ["-text", "${hello.text}"]
ports:
- - ${hello.port}:5678
+ - "${hello.port}:5678"
```
Update the `parameters.yml` file to the following:
-```
+```yaml
hello:
port: 8080
text: Hello world!
@@ -147,7 +147,7 @@ It is a quick way to check how to configure the application before deployment, w
the `Compose file`. It's important to note that the application is not running at this point, and that
the `inspect` operation inspects the configuration file(s).
-```
+```console
$ docker app inspect hello-world.dockerapp
hello-world 0.1.0
@@ -171,7 +171,7 @@ The application is ready to be validated and rendered.
Docker App provides the `validate` subcommand to check syntax and other aspects of the configuration.
If the app passes validation, the command returns no arguments.
-```
+```console
$ docker app validate hello-world.dockerapp
Validated "hello-world.dockerapp"
```
@@ -199,7 +199,7 @@ Use `docker app install` to deploy the application.
Use the following command to deploy (install) the application.
-```
+```console
$ docker app install hello-world.dockerapp --name my-app
Creating network my-app_default
Creating service my-app_hello
@@ -211,7 +211,7 @@ installation container and as a target context to deploy the application. You ca
using the flag `--target-context` or by using the environment variable `DOCKER_TARGET_CONTEXT`. This flag is also
available for the commands `status`, `upgrade`, and `uninstall`.
-```
+```console
$ docker app install hello-world.dockerapp --name my-app --target-context=my-big-production-cluster
Creating network my-app_default
Creating service my-app_hello
@@ -223,7 +223,7 @@ valid if they are deployed on different target contexts.
You can check the status of the app with the `docker app status ` command.
-```
+```console
$ docker app status my-app
INSTALLATION
------------
@@ -254,7 +254,7 @@ miqdk1v7j3zk my-app_hello replicated 1/1 hashicorp/http-echo:la
The app is deployed using the stack orchestrator. This means you can also inspect it using the regular `docker stack` commands.
-```
+```console
$ docker stack ls
NAME SERVICES ORCHESTRATOR
my-app 1 Swarm
@@ -265,7 +265,8 @@ port 8080 and see the app. You must ensure traffic to port 8080 is allowed on
the connection from your browser to your Docker host.
Now change the port of the application using `docker app upgrade ` command.
-```
+
+```console
$ docker app upgrade my-app --set hello.port=8181
Upgrading service my-app_hello
Application "my-app" upgraded on context "default"
@@ -286,13 +287,13 @@ Rendering is the process of reading the entire application configuration and out
Use the following command to render the app to a Compose file called `docker-compose.yml` in the current directory.
-```
+```console
$ docker app render --output docker-compose.yml hello-world.dockerapp
```
Check the contents of the resulting `docker-compose.yml` file.
-```
+```console
$ cat docker-compose.yml
version: "3.6"
services:
@@ -315,7 +316,7 @@ section of the project's YAML file. For example, `${hello.text}` has been expand
Try to render the application with a different text:
-```
+```console
$ docker app render hello-world.dockerapp --set hello.text="Hello whales!"
version: "3.6"
services:
@@ -333,7 +334,7 @@ services:
Use `docker-compose up` to deploy the app.
-```
+```console
$ docker-compose up --detach
WARNING: The Docker Engine you're using is running in swarm mode.
@@ -354,7 +355,7 @@ Deploying the app as a Docker stack is a two-step process very similar to deploy
Complete the steps in the previous section to render the Docker app project as a Compose file and make sure
you're ready to deploy it as a Docker Stack. Your Docker host must be in Swarm mode.
-```
+```console
$ docker stack deploy hello-world-app -c docker-compose.yml
Creating network hello-world-app_default
Creating service hello-world-app_hello
@@ -394,7 +395,7 @@ $ docker app push my-app --platform="linux/amd64" --tag /:0.1.0
Now that the app is pushed to the registry, try an `inspect` and `install` command against it.
The location of your app is different from the one provided in the examples.
-```
+```console
$ docker app inspect myuser/hello-world:0.1.0
hello-world 0.1.0
@@ -412,7 +413,7 @@ This action was performed directly against the app in the registry.
Now install it as a native Docker App by referencing the app in the registry, with a different port.
-```
+```console
$ docker app install myuser/hello-world:0.1.0 --set hello.port=8181
Creating network hello-world_default
Creating service hello-world_hello
@@ -424,14 +425,14 @@ Test that the app is working.
The app used in these examples is a simple web server that displays the text "Hello world!" on port 8181,
your app might be different.
-```
+```console
$ curl http://localhost:8181
Hello world!
```
Uninstall the app.
-```
+```console
$ docker app uninstall hello-world
Removing service hello-world_hello
Removing network hello-world_default
diff --git a/engine/release-notes/18.09.md b/engine/release-notes/18.09.md
index d26b1f849b..d66826473b 100644
--- a/engine/release-notes/18.09.md
+++ b/engine/release-notes/18.09.md
@@ -192,6 +192,7 @@ Run the following command to get the current value of the `MountFlags` property
$ sudo systemctl show --property=MountFlags docker.service
MountFlags=
```
+
Update your configuration if this command prints a non-empty value for `MountFlags`, and restart the docker service.
### Security fixes
diff --git a/engine/scan/index.md b/engine/scan/index.md
index 4ee07235b7..e949682c2b 100644
--- a/engine/scan/index.md
+++ b/engine/scan/index.md
@@ -205,6 +205,7 @@ $ docker scan --json --group-issues docker-scan:e2e
"path": "docker-scan:e2e"
}
```
+
You can find all the sources of the vulnerability in the `from` section.
### Checking the dependency tree
diff --git a/engine/security/rootless.md b/engine/security/rootless.md
index 0ab5148919..ff5ccb100a 100644
--- a/engine/security/rootless.md
+++ b/engine/security/rootless.md
@@ -176,6 +176,7 @@ If `dockerd-rootless-setuptool.sh` is not present, you may need to install the `
```console
$ sudo apt-get install -y docker-ce-rootless-extras
```
+
If you do not have permission to run package managers like `apt-get` and `dnf`,
diff --git a/engine/security/seccomp.md b/engine/security/seccomp.md
index 6ac67a1886..b4f51d3662 100644
--- a/engine/security/seccomp.md
+++ b/engine/security/seccomp.md
@@ -120,7 +120,7 @@ the reason each syscall is blocked rather than white-listed.
You can pass `unconfined` to run a container without the default seccomp
profile.
-```
+```console
$ docker run --rm -it --security-opt seccomp=unconfined debian:jessie \
unshare --map-root-user --user sh -c whoami
```
diff --git a/engine/security/trust/index.md b/engine/security/trust/index.md
index 24cb2c12f0..9b5ac9e3aa 100644
--- a/engine/security/trust/index.md
+++ b/engine/security/trust/index.md
@@ -130,7 +130,7 @@ is automatically added to the local trust store. If you are importing a separate
key, you will need to use the
`$ docker trust key load` command.
-```
+```console
$ docker trust key generate jeff
Generating key for jeff...
Enter passphrase for new jeff key with ID 9deed25:
@@ -140,7 +140,7 @@ Successfully generated and loaded private key. Corresponding public key availabl
Or if you have an existing key:
-```
+```console
$ docker trust key load key.pem --name jeff
Loading key from "key.pem"...
Enter passphrase for new jeff key with ID 8ae710e:
@@ -156,7 +156,7 @@ canonical root key. To understand more about initiating a repository, and the
role of delegations, head to
[delegations for content trust](trust_delegation.md).
-```
+```console
$ docker trust signer add --key cert.pem jeff registry.example.com/admin/demo
Adding signer "jeff" to registry.example.com/admin/demo...
Enter passphrase for new repository key with ID 10b5e94:
@@ -165,7 +165,7 @@ Enter passphrase for new repository key with ID 10b5e94:
Finally, we will use the delegation private key to sign a particular tag and
push it up to the registry.
-```
+```console
$ docker trust sign registry.example.com/admin/demo:1
Signing and pushing trust data for local image registry.example.com/admin/demo:1, may overwrite remote trust data
The push refers to repository [registry.example.com/admin/demo]
@@ -179,7 +179,7 @@ Successfully signed registry.example.com/admin/demo:1
Alternatively, once the keys have been imported an image can be pushed with the
`$ docker push` command, by exporting the DCT environmental variable.
-```
+```console
$ export DOCKER_CONTENT_TRUST=1
$ docker push registry.example.com/admin/demo:1
@@ -194,7 +194,7 @@ Successfully signed registry.example.com/admin/demo:1
Remote trust data for a tag or a repository can be viewed by the
`$ docker trust inspect` command:
-```
+```console
$ docker trust inspect --pretty registry.example.com/admin/demo:1
Signatures for registry.example.com/admin/demo:1
@@ -215,7 +215,7 @@ Administrative keys for registry.example.com/admin/demo:1
Remote Trust data for a tag can be removed by the `$ docker trust revoke` command:
-```
+```console
$ docker trust revoke registry.example.com/admin/demo:1
Enter passphrase for signer key with ID 8ae710e:
Successfully deleted signature for registry.example.com/admin/demo:1
@@ -241,7 +241,7 @@ For example, with DCT enabled a `docker pull someimage:latest` only
succeeds if `someimage:latest` is signed. However, an operation with an explicit
content hash always succeeds as long as the hash exists:
-```
+```console
$ docker pull registry.example.com/user/image:1
Error: remote trust data does not exist for registry.example.com/user/image: registry.example.com does not have trust data for registry.example.com/user/image
diff --git a/engine/security/trust/trust_automation.md b/engine/security/trust/trust_automation.md
index f1647cf4f8..3f59a96047 100644
--- a/engine/security/trust/trust_automation.md
+++ b/engine/security/trust/trust_automation.md
@@ -20,7 +20,7 @@ To automate importing a delegation private key to the local Docker trust store,
need to pass a passphrase for the new key. This passphrase will be required
everytime that delegation signs a tag.
-```
+```console
$ export DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE="mypassphrase123"
$ docker trust key load delegation.key --name jeff
@@ -35,7 +35,7 @@ public key, then you will need to use the local Notary Canonical Root Key's
passphrase to create the repositories trust data. If the repository has already
been initiated then you only need the repositories passphrase.
-```
+```console
# Export the Local Root Key Passphrase if required.
$ export DOCKER_CONTENT_TRUST_ROOT_PASSPHRASE="rootpassphrase123"
@@ -56,7 +56,7 @@ Finally when signing an image, we will need to export the passphrase of the
signing key. This was created when the key was loaded into the local Docker
trust store with `$ docker trust key load`.
-```
+```console
$ export DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE="mypassphrase123"
$ docker trust sign registry.example.com/admin/demo:1
diff --git a/engine/security/trust/trust_delegation.md b/engine/security/trust/trust_delegation.md
index a5c4480573..21d5bd15df 100644
--- a/engine/security/trust/trust_delegation.md
+++ b/engine/security/trust/trust_delegation.md
@@ -28,28 +28,28 @@ server URL is the same as the registry URL. However, for self-hosted
environments or 3rd party registries, you will need to specify an alternative
URL for the notary server. This is done with:
-```
-export DOCKER_CONTENT_TRUST_SERVER=https://:
+```console
+$ export DOCKER_CONTENT_TRUST_SERVER=https://:
```
If you do not export this variable in self-hosted environments, you may see
errors such as:
-```
+```console
$ docker trust signer add --key cert.pem jeff registry.example.com/admin/demo
Adding signer "jeff" to registry.example.com/admin/demo...
-[...]
+<...>
Error: trust data missing for remote repository registry.example.com/admin/demo or remote repository not found: timestamp key trust data unavailable. Has a notary repository been initialized?
$ docker trust inspect registry.example.com/admin/demo --pretty
WARN[0000] Error while downloading remote metadata, using cached timestamp - this might not be the latest version available remotely
-[...]
+<...>
```
If you have enabled authentication for your notary server, or are using DTR, you will need to log in
before you can push data to the notary server.
-```
+```console
$ docker login registry.example.com/user/repo
Username: admin
Password:
diff --git a/engine/security/trust/trust_key_mng.md b/engine/security/trust/trust_key_mng.md
index e5da1f7a6e..a8aa06b8e5 100644
--- a/engine/security/trust/trust_key_mng.md
+++ b/engine/security/trust/trust_key_mng.md
@@ -79,7 +79,7 @@ This loss also requires **manual intervention** from every consumer that pulled
the tagged image prior to the loss. Image consumers would get an error for
content that they already downloaded:
-```
+```console
Warning: potential malicious behavior - trust data has insufficient signatures for remote repository docker.io/my/image: valid signatures did not meet threshold
```
diff --git a/engine/swarm/configs.md b/engine/swarm/configs.md
index edcdbb732f..fc2f7dbe9a 100644
--- a/engine/swarm/configs.md
+++ b/engine/swarm/configs.md
@@ -244,6 +244,7 @@ This example assumes that you have PowerShell installed.