4.3 KiB
| description | keywords | title |
|---|---|---|
| Registry Access Management | registry, access, managment | Registry Access Management |
Registry Access Management is a feature available to organizations with a Docker Business subscription. This feature lets organization owners manage the registries that their developers can access while using Docker Desktop. When using this feature, organization owners can ensure that their developers can only access their trusted registries, such as a secure private registry on Artifactory, thereby reducing the security risks that can occur when developers interact with public registries.
Configure Registry Access Management permissions
To configure Registry Access Management permissions, perform the following steps:
-
Sign into your Docker Hub{: target="blank" rel="noopener" class=""} account as an organization owner.
-
Select an organization, navigate to the Settings tab on the Organizations page and click Registry Access.
-
Enable Registry Access Management to set the permissions for your registry.
Note
When enabled, the Docker Hub registry is set by default, however you can also restrict this registry for your developers.
-
Click Add and enter your registry details in the applicable fields, and click Create to add the registry to your list.
-
Verify that the registry appears in your list and click Save & Apply. You can verify that your changes are saved in the Activity tab.
Note
Once you add a registry, it can take up to 24 hours for the changes to be enforced on your developers’ machines. If you want to apply the changes sooner, you must force a Docker logout on your developers’ machine and have the developers re-authenticate for Docker Desktop. Also, there is no limit on the number of registries you can add. See the Caveats section to learn more about limitations when using this feature.
{:width="700px"}
Enforce authentication
To ensure that each org member uses Registry Access Management on their local machine, you can perform the steps below to enforce sign-in under your organization. To do this:
- Download the latest version of Docker Desktop, and then
- Create a
registry.jsonfile.
Download Docker Desktop 4.8 or a later release.
Creating a registry.json file
When creating a registry.json file, ensure that the developer is a member of at least one organization in Docker Hub. If the registry.json file matches at least one organization the developer is a member of, they can sign in to Docker Desktop and access all their organizations. Learn more on how to create a registry.json file on Windows or Mac.
Verify the restrictions
The new Registry Access Management policy should be in place after the developer successfully authenticates to Docker Desktop using their organization credentials. The developer can attempt to pull an image from a disallowed registry via the Docker CLI. They will then receive an error message that your organization disallows this container registry.
Caveats
There are certain limitations when using Registry Access Management; they are as follows:
- Windows image pulls, and image builds are not restricted
- Builds such as
docker buildxusing a Kubernetes driver are not restricted - Builds such as
docker buildxusing a custom docker-container driver are not restricted - Blocking is DNS-based; you must use a registry's access control mechanisms to distinguish between “push” and “pull”
- WSL 2 requires at least a 5.4 series Linux kernel (this does not apply to earlier Linux kernel series)
- Under the WSL 2 network, traffic from all Linux distributions is restricted (this will be resolved in the updated 5.15 series Linux kernel)
Also, Registry Access Management operates on the level of hosts, not IP addresses. Developers can bypass this restriction within their domain resolution, for example by running Docker against a local proxy or modifying their operating system's sts file. Blocking these forms of manipulation is outside the remit of Docker Desktop.