Skip to content

Commit 0f607d3

Browse files
craig-osterhoutcraig-osterhout
authored
hub: add namespace access control (#23949)
<!--Delete sections as needed --> ## Description Added namespace access control feature: - https://deploy-preview-23949--docsdocker.netlify.app/enterprise/security/hardened-desktop/namespace-access/ - https://deploy-preview-23949--docsdocker.netlify.app/enterprise/security/hardened-desktop/ - https://deploy-preview-23949--docsdocker.netlify.app/enterprise/security/roles-and-permissions/core-roles/ - https://deploy-preview-23949--docsdocker.netlify.app/platform-release-notes/ Added public repo creation feature: - https://deploy-preview-23949--docsdocker.netlify.app/docker-hub/settings/ - https://deploy-preview-23949--docsdocker.netlify.app/enterprise/security/roles-and-permissions/core-roles/ - https://deploy-preview-23949--docsdocker.netlify.app/docker-hub/release-notes/ ## Related issues or tickets ENGDOCS-3141 ## Reviews <!-- Notes for reviewers here --> <!-- List applicable reviews (optionally @tag reviewers) --> - [ ] Editorial review - [ ] Product review --------- Signed-off-by: Craig Osterhout <craig.osterhout@docker.com>
1 parent 7c2d7ac commit 0f607d3

10 files changed

Lines changed: 185 additions & 55 deletions

File tree

‎content/manuals/docker-hub/_index.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,10 @@ grid:
2020
or the Docker community.
2121
icon: inbox
2222
link: /docker-hub/repos
23+
- title: Settings
24+
description: Learn about settings in Docker Hub.
25+
icon: settings
26+
link: /docker-hub/settings
2327
- title: Organizations
2428
description: Learn about organization administration.
2529
icon: store

‎content/manuals/docker-hub/release-notes.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,14 @@ tags: [Release notes]
1313
Here you can learn about the latest changes, new features, bug fixes, and
1414
known issues for each Docker Hub release.
1515

16+
## 2026-02-13
17+
18+
### New
19+
20+
- Administrators can now prevent creating public repositories within
21+
organization namespaces using the [Disable public
22+
repositories](./settings.md#disable-creation-of-public-repos) setting.
23+
1624
## 2025-02-18
1725

1826
### New

‎content/manuals/docker-hub/repos/_index.md‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,3 @@ In this section, learn how to:
5454

5555
- [Archive](./archive.md) an outdated or unsupported repository.
5656
- [Delete](./delete.md) a repository.
57-
- [Manage personal settings](./settings.md): For your account, you can set personal
58-
settings for repositories, including default repository privacy and autobuild
59-
notifications.

‎content/manuals/docker-hub/repos/settings.md‎

Lines changed: 0 additions & 52 deletions
This file was deleted.

‎content/manuals/docker-hub/settings.md‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
---
2+
description: Learn about settings in Docker Hub
3+
keywords: Docker Hub, Hub, repositories, settings
4+
title: Settings
5+
weight: 25
6+
---
7+
8+
You can configure the following settings in Docker Hub:
9+
10+
- [Default privacy](#default-privacy): Settings for all repositories within each
11+
namespace
12+
- [Notifications](#notifications): Personal settings for autobuild notifications
13+
14+
## Default privacy
15+
16+
You can configure the following default privacy settings for all repositories in
17+
a namespace:
18+
19+
- [Disable creation of public repos](#disable-creation-of-public-repos): Prevent
20+
organization users from creating public repositories (organization namespaces
21+
only)
22+
- [Configure default repository privacy](#configure-default-repository-privacy):
23+
Set the default repository privacy for new repositories
24+
25+
26+
### Disable creation of public repos
27+
28+
{{< summary-bar feature_name="Disable public repositories" >}}
29+
30+
Organization owners and editors can prevent creating public repositories within
31+
organization namespaces. You cannot configure this setting for personal account
32+
namespaces.
33+
34+
> [!NOTE]
35+
>
36+
> Enabling this feature does not affect existing public repositories. Any public
37+
> repositories that already exist will remain public. To make them private, you
38+
> must change their visibility in the individual repository settings.
39+
40+
To configure the disable public repositories setting for an organization
41+
namespace:
42+
43+
1. Sign in to [Docker Hub](https://hub.docker.com).
44+
2. Select **My Hub**.
45+
3. Select your organization from the top-left account drop-down.
46+
4. Select **Settings** > **Default privacy**.
47+
5. Toggle **Disable public repositories** to your desired setting.
48+
6. Select **Save**.
49+
50+
### Configure default repository privacy
51+
52+
Use the default repository privacy setting to automatically set privacy for
53+
repositories created via `docker push` commands when the repository doesn't
54+
exist yet. In this case, Docker Hub automatically creates the repository with
55+
the default repository privacy for that namespace.
56+
57+
> [!NOTE]
58+
>
59+
> You cannot configure the default repository privacy setting when **Disable
60+
> public repositories** is enabled.
61+
62+
To configure the default repository privacy for a namespace:
63+
64+
1. Sign in to [Docker Hub](https://hub.docker.com).
65+
2. Select **My Hub**.
66+
3. Select your organization or account from the top-left account drop-down.
67+
4. Select **Settings** > **Default privacy**.
68+
5. In **Default repository privacy**, select the desired default privacy setting:
69+
70+
- **Public**: All new repositories appear in Docker Hub search results and can be
71+
pulled by everyone.
72+
- **Private**: All new repositories don't appear in Docker Hub search results
73+
and are only accessible to you and collaborators. In addition, if the
74+
repository is created in an organization's namespace, then the repository
75+
is accessible to those with applicable roles or permissions.
76+
77+
6. Select **Save**.
78+
79+
## Notifications
80+
81+
You can send notifications to your email for all your repositories using
82+
autobuilds.
83+
84+
### Configure autobuild notifications
85+
86+
1. Sign in to [Docker Hub](https://hub.docker.com).
87+
2. Select **My Hub**.
88+
3. Select your personal account from the top-left account drop-down.
89+
4. Select **Settings** > **Notifications**.
90+
5. Select the notifications to receive by email:
91+
92+
- **Off**: No notifications.
93+
- **Only failures**: Only notifications about failed builds.
94+
- **Everything**: Notifications for successful and failed builds.
95+
96+
6. Select **Save**.

‎content/manuals/enterprise/security/hardened-desktop/_index.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,10 @@ grid:
2828
description: Restrict containers from accessing unwanted network resources.
2929
icon: "vpn_lock"
3030
link: /enterprise/security/hardened-desktop/air-gapped-containers/
31+
- title: "Namespace access"
32+
description: Control whether organization members can push content to their personal namespaces.
33+
icon: "folder_managed"
34+
link: /enterprise/security/hardened-desktop/namespace-access/
3135
weight: 60
3236
---
3337

@@ -52,6 +56,7 @@ Hardened Docker Desktop features work independently and together to create a def
5256
- Registry Access Management and Image Access Management prevent access to unauthorized container registries and image types, reducing exposure to malicious payloads
5357
- Enhanced Container Isolation runs containers without root privileges inside a Linux user namespace, limiting the impact of malicious containers
5458
- Air-gapped containers let you configure network restrictions for containers, preventing malicious containers from accessing your organization's internal network resources
59+
- Namespace access controls whether organization members can push content to their personal Docker Hub namespaces, preventing accidental publication of images outside approved locations
5560
- Settings Management locks down Docker Desktop configurations to enforce company policies and prevent developers from introducing insecure settings, whether intentionally or accidentally
5661

5762
## Next steps

‎content/manuals/enterprise/security/hardened-desktop/namespace-access.md‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
---
2+
title: Namespace access control
3+
linkTitle: Namespace access
4+
description: Control whether organization members can push content to their personal namespaces on Docker Hub
5+
keywords: namespace access, docker hub, personal namespace, organization security, docker business
6+
tags: [admin]
7+
weight: 50
8+
---
9+
10+
{{< summary-bar feature_name="Namespace access" >}}
11+
12+
Namespace access control lets organization administrators control whether all
13+
members of an organization can push content to their personal namespaces on
14+
Docker Hub. This prevents organizations from accidentally publishing images
15+
outside of approved, governed locations.
16+
17+
When namespace access control is enabled, organization members can still view and pull images
18+
from their personal namespaces and continue accessing all existing repositories
19+
and content. However, they will no longer be able to create new repositories or
20+
push new images to their personal namespace.
21+
22+
> [!IMPORTANT]
23+
>
24+
> For users in multiple organizations, if namespace access control is enabled in
25+
> any organization, that user cannot push to their personal namespace and cannot
26+
> create new repositories in their personal namespace.
27+
28+
### Configure namespace access control
29+
30+
To configure namespace access control:
31+
32+
1. Sign in to [Docker Home](https://app.docker.com/) and select your
33+
organization from the top-left account drop-down.
34+
2. Select **Admin Console**, then **Namespace access**.
35+
3. Use the toggle to enable or disable namespace access control.
36+
4. Select **Save changes**.
37+
38+
Once namespace access control is enabled, organization members can still view their
39+
personal namespace and existing repositories but they will not be able to create
40+
any new repositories or push any new images to existing repositories.
41+
42+
### Verify access restrictions
43+
44+
After configuring namespace access control, test that restrictions work correctly.
45+
46+
After any attempt to push to an existing repository in your personal namespace,
47+
you'll see an error message like the following:
48+
49+
```console
50+
$ docker push <personal-namespace>/<image>:<tag>
51+
Unavailable
52+
authentication required - namespace access restriction from an organization you belong to prevents pushing new content in your personal namespace. Restriction applied by: <organizations>. Please contact your organization administrator
53+
```

‎content/manuals/enterprise/security/roles-and-permissions/core-roles.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@ These permissions apply organization-wide, including all repositories in your or
3737
| Edit and delete publisher repository logos | ❌ | ✅ | ✅ |
3838
| Observe content engagement as a publisher | ❌ | ❌ | ✅ |
3939
| Create public and private repositories | ❌ | ✅ | ✅ |
40+
| Disable public repositories | ❌ | ✅ | ✅ |
4041
| Edit and delete repositories | ❌ | ✅ | ✅ |
4142
| Manage tags | ❌ | ✅ | ✅ |
4243
| View repository activity | ❌ | ❌ | ✅ |
@@ -66,6 +67,7 @@ beyond their organization role:
6667
| Export and reporting | ❌ | ❌ | ✅ |
6768
| Image Access Management | ❌ | ❌ | ✅ |
6869
| Registry Access Management | ❌ | ❌ | ✅ |
70+
| Namespace access control | ❌ | ❌ | ✅ |
6971
| Set up Single Sign-On (SSO) and SCIM | ❌ | ❌ | ✅ \* |
7072
| Require Docker Desktop sign-in | ❌ | ❌ | ✅ \* |
7173
| Manage billing information (for example, billing address) | ❌ | ❌ | ✅ |

‎content/manuals/platform-release-notes.md‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,17 @@ tags: [Release notes, admin]
1212

1313
This page provides details on new features, enhancements, known issues, and bug fixes across Docker Home, the Admin Console, billing, security, and subscription functionalities.
1414

15+
## 2026-02-13
16+
17+
### New
18+
19+
- Administrators can now control whether organization members can push content
20+
to their personal namespaces on Docker Hub with [namespace access
21+
control](/manuals/enterprise/security/hardened-desktop/namespace-access.md).
22+
- Administrators can now prevent creating public repositories within
23+
organization namespaces using the [Disable public
24+
repositories](/manuals/docker-hub/settings.md#disable-creation-of-public-repos) setting.
25+
1526
## 2026-01-27
1627

1728
### New

‎data/summary.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -218,8 +218,14 @@ GitHub Actions cache:
218218
Hardened Docker Desktop:
219219
subscription: [Business]
220220
for: Administrators
221+
Disable public repositories:
222+
subscription: [Business]
223+
for: Administrators
221224
Image management:
222225
availability: Beta
226+
Namespace access:
227+
subscription: [Business]
228+
for: Administrators
223229
Immutable tags:
224230
availability: Beta
225231
Import builds:

0 commit comments

Comments
 (0)