[Go to site: main page, start]
Share feedback
Answers are generated based on the documentation.
{ const container = $el; // The div with overflow const item = document.getElementById('sidebar-current-page') if (item) { const containerTop = container.scrollTop; const containerBottom = containerTop + container.clientHeight; const itemTop = item.offsetTop - container.offsetTop; const itemBottom = itemTop + item.offsetHeight; // Scroll only if the item is out of view if (itemBottom > containerBottom - 200) { container.scrollTop = itemTop - (container.clientHeight / 2 - item.offsetHeight / 2); } } })" class="bg-background-toc dark:bg-background-toc fixed top-0 z-40 hidden h-screen w-full flex-none overflow-x-hidden overflow-y-auto md:sticky md:top-16 md:z-auto md:block md:h-[calc(100vh-64px)] md:w-[320px]" :class="{ 'hidden': ! $store.showSidebar }">
Manuals

Enforce sign-in for Docker Desktop

Table of contents
Subscription: Team Business
For: Administrators

By default, users can access Docker Desktop without signing in to your organization. When users don't sign in as organization members, they miss out on subscription benefits and can bypass security features configured for your organization.

You can enforce sign-in using several methods, depending on your setup:

Deploying a admin-settings.json file with Settings Management also enforces sign-in. See Settings Management and sign-in enforcement.

This page provides an overview of how sign-in enforcement works.

How sign-in enforcement works

When Docker Desktop detects a registry key, configuration profile, .plist file, or registry.json file:

  • A Sign in using your work email address prompt appears, requiring users to sign in as organization members to use Docker Desktop. The prompt states which organizations are required and which method enforces it.
  • If users sign in with accounts that aren't organization members, they're automatically signed out and can't use Docker Desktop. The prompt changes to You have been signed out and explains why. They can sign in again with a different account.
  • When users sign in with organization member accounts, they can use Docker Desktop normally.
  • When users sign out, the sign-in prompt reappears and they can no longer use Docker Desktop unless they sign back in.

Impact on the Docker CLI

Sign-in enforcement also blocks the Docker CLI. While the sign-in prompt is showing, Docker Desktop's API proxy rejects almost every request with an explanation at the terminal, for example:

Sign in to continue using Docker Desktop. Membership in the [myorg] organization
is required. Sign in enforced by your administrators (via registry.json).
  • docker run, docker pull, docker build, docker ps, and other commands that reach the engine fail until the user signs in.
  • docker version, docker info, and docker login continue to work, so users can sign in from the CLI.
Important

Make sure you plan for blocking the Docker CLI before you roll out enforcement. Any scripted or CI use of the Docker CLI on an enforced machine stops working until that machine's user signs in as an organization member.

Sign-in enforcement is separate from SSO enforcement, which governs how users authenticate as opposed to whether they must authenticate.

Impact on already-signed-in users

When enforcement is first deployed, users who are already running Docker Desktop are not immediately affected. Docker Desktop re-evaluates enforcement when it starts, and when a user signs in or out. It doesn't poll for new configuration while running, so a newly deployed registry key, configuration profile, .plist, or registry.json file takes effect on the next restart.

On the next Docker Desktop restart:

  • Users signed in with an organization member account are automatically re-authenticated and continue working uninterrupted.
  • Users signed in with a non-member account are immediately signed out on startup and see the Sign in required! prompt.

Enforcing sign-in versus enforcing single sign-on (SSO)

Enforcing Docker Desktop sign-in and enforcing SSO are different features that serve different purposes:

EnforcementDescriptionBenefits
Enforce sign-in onlyUsers must sign in before using Docker DesktopEnsures users receive the benefits of your subscription and ensures security features are applied. In addition, you gain insights into users’ activity.
Enforce single sign-on (SSO) onlyIf users sign in, they must sign in using SSOCentralizes authentication and enforces unified policies set by the identity provider.
Enforce bothUsers must sign in using SSO before using Docker DesktopEnsures users receive the benefits of your subscription and ensures security features are applied. In addition, you gain insights into users’ activity. It also centralizes authentication and enforces unified policies set by the identity provider.
Enforce neitherIf users sign in, they can use SSO or their Docker credentialsLets users access Docker Desktop without barriers, at the cost of reduced security and insights.

Next steps