The workflow turns SBOM/provenance on for pushes and off for PRs, then
the next note said those attestations break local compare. That's the
same split: compare only runs on PRs, where the image is loaded without
attestations.
Fixes#25851
---------
Signed-off-by: Dean Chen <862469039@qq.com>
Co-authored-by: Craig Osterhout <craig.osterhout@docker.com>
# To dos
~- Evaluate _index pages and standardize across account + admins
category~
~- Edit weights of topics~
- Notify TSEs, other stakeholders
- TW sign off
## Summary
This PR restructures the Platform documentation into a clearer Accounts,
Security, and Subscription and billing information architecture, with
aliases so existing URLs keep working.
Work from these PRs was merged into this feature branch:
- #25957 (Security IA)
- #25960 (Accounts and Admin)
- #25981 (Subscription and billing)
### Accounts
- Moves organization, company, and admin content under Accounts.
- Splits individual-account docs into their own subsection.
- Removes the standalone Admin section; those pages now live under
Accounts.
### Security
- Publishes Security at `/security/`, matching other Platform sections.
- Groups authentication (SSO, 2FA, OIDC), access tokens, provisioning,
and roles under Security.
- Leaves Enterprise Hardened Desktop and related enterprise security
docs under Enterprise.
- Restores shipped Hardened Desktop and security FAQ URLs so they match
`main`.
### Subscription and billing
- Merges Subscription and Billing into a single Subscription and billing
section.
- Drops the extra subcategory wrappers and nests billing tasks under
Manage.
- Shortens the billing details sidebar label.
### FAQs
- Consolidates Platform FAQs onto four pages: Accounts, Security,
Subscription and billing, and Platform.
- Folds leftover general, container, and network/VM security FAQs into
Platform FAQs.
- Folds SSO enforcement FAQs into the SSO FAQ.
- Templates FAQ pages with H2 topics and H3 questions, and limits the
table of contents to H2.
### Navigation and follow-ups
- Renames the manuals sidebar group from Platform to Accounts and admin,
and updates the manuals landing heading and copy to match.
- Fixes the MSI install Settings Management link after the security path
move.
- Updates CODEOWNERS, the labeler, and in-repo links to the new paths.
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
Fixes#25997
Add notes to the Docker Hub tag and image-management deletion
instructions explaining that immutable tags cannot be deleted and
linking to the immutable-tags guide.
Validation:
- `git diff --check` passed
- Local Prettier could not run because `prettier-plugin-go-template` is
unavailable
- Docker lint/Vale could not run because the Docker CLI is unavailable
- GitHub Actions should provide repository validation and preview checks
Co-authored-by: Niels Kaspers <nielskaspers@users.noreply.github.com>
<!--Delete sections as needed -->
## Description
<!-- Tell us what you did and why -->
This PR adds a link to the migration guide in every deprecation notice
in autobuilds pages.
Also, it moves the page up in the navigation, right under the main one
to ease its finding as it is a the most important one from now on.
## Related issues or tickets
https://docker.atlassian.net/browse/DSB-245
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
## Summary
- Document that member `PUT` `role` accepts a custom role **name**, not
only `owner` | `editor` | `member`.
- Document `role` on team `PATCH` (core or custom role name) and on
`org_group` so the PATCH 200 can include the assigned role.
- Add `Editor` to `org_member.role` (title case). Live responses already
return it; the old enum was Owner / Member / Invitee only.
## Test plan
PM must confirm before merge:
- [ ] Member PUT 200: after assigning a custom role (body is not the
previous core role), is `role` still a core value (`Owner` / `Editor` /
`Member`), or is it the custom role **name**? If it is the custom name,
drop the `org_member.role` enum in a follow-up and describe a string
(core or custom name). If it stays a core value, this PR's enum (`Owner`
| `Editor` | `Member` | `Invitee`) is enough.
- [ ] List members: same field. Confirm a user with a custom role lists
as a core value vs the custom name.
- [ ] Casing: request stays lowercase (`editor`); response stays title
case (`Editor`). Confirm that split is real.
- [ ] Team PATCH 200: confirm `org_group.role` is present and is the
value just set (core or custom name).
- [ ] Team assignment is PATCH-only, not PUT.
- [ ] Unknown role names return an error; do not document them as valid.
- [ ] Custom role **name** (not label or UUID) is the request
identifier, matching Docker Home.
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
Docker Engine 29.8 can render docker-default from a daemon-configured Go
template.
Document the supported template data, safe file placement, daemon
configuration, and verification so administrators do not treat the
template as a directly loadable profile.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Explain how Engine 29.7.0 can run containerd inside dockerd, how to
enable and verify the experimental mode, and how external clients can
connect to its endpoint.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The FAQ did not explicitly state that Open is selected by default for every sandbox type. Clarify that Open permits all outbound destinations and list the options for restricting egress.
Co-Authored-By: Claude <noreply@anthropic.com>
<!--Delete sections as needed -->
## Description
Flips the Docker Scout features that reached their retirement dates from
"deprecated" to retired, and removes the topics for them.
Docs now describe only the current product — retirement dates and
history
live in the release notes and the retired products page.
https://deploy-preview-25965--docsdocker.netlify.app/scout/
## Retired features and topics updated
| Feature | Retired | Topics |
|---|---|---|
| Slack integration | Jul 30 | Deleted
`integrations/team-collaboration/` |
| Notifications | Sep 1 | Removed notification settings from
`explore/dashboard.md` |
| Amazon ECR (native) | Sep 1 | Deleted `registry/ecr.md` |
| Azure ACR (native) | Sep 1 | Deleted `registry/acr.md` |
| Policies page in Dashboard | Sep 1 | Deleted `policy/dashboard.md`,
trimmed `policy/_index.md` and `policy/local.md` |
| SonarQube integration | Sep 1 | Deleted `integrations/code-quality/` |
| GitHub SCM integration | Jul 1 | Deleted leftover
`source-code-management/` topic; migration guidance moved to
`retired.md` |
ECR and ACR are still supported through `docker scout watch` — only the
native
integrations are gone.
## New
- `integrations/registry.md` — generic registry topic covering any
OCI-compliant registry, with Artifactory as the worked example. Replaces
the
per-registry topics, including `registry/artifactory.md`.
## Also
- Release notes: kept the original deprecation announcements (links
removed),
added retirement entries for Jul 30 and Sep 1.
- `retired.md`: entries updated, aliases added for all removed topics.
- Fixed a stale claim in `build/building/best-practices.md` that Scout
raises
pull requests to update base images — that was the retired GitHub
integration. Now points to Dependabot.
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
Signed-off-by: Craig Osterhout <craig.osterhout@docker.com>
Keep the legacy-link reference while warning that default-bridge links
and legacy-link environment variables are scheduled for removal in
Docker Engine 30.0.
Document the environment variable escape hatch.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
## Summary
Support was sending customers to Docker Home Billing, then the product
catalog, then **View plans** to upgrade to Docker Pro. The way to
upgrade to Pro is the [Docker pricing
page](https://www.docker.com/pricing/): select **Buy now**.
This change puts that path in three owned CTAs and retargets inbound
upgrade links so they land on those CTAs instead of restating the same
sentence.
**Why 3 copy locations:** Docker Pro purchase copy should live only
where people (and Gordon) look: the Docker plans page, the subscription
FAQ, and Manage plans (the upgrade landing page, including
`/subscription/upgrade/`). Repeating a Pro → pricing aside on every
overview and feature page would drift when Billing changes the flow.
Three sentences are the maintainable set.
**Why silent links:** `/subscription/` and the plans index currently
imply every plan is purchased from Docker Home Billing / the product
catalog. Those pages should point at Manage plans / Docker plans instead
of restating Pro copy. Hub pull-limit troubleshooting and Build Cloud
cache "upgrade your subscription" sent Personal users to
`manage.md#upgrade-plans` (catalog). Retarget those links at the Docker
plans page so they pick up the owned CTA without a fourth/fifth copy.
@netlify /subscription/plans/docker/
Preview:
-
https://deploy-preview-25992--docsdocker.netlify.app/subscription/plans/docker/
- https://deploy-preview-25992--docsdocker.netlify.app/subscription/faq/
-
https://deploy-preview-25992--docsdocker.netlify.app/subscription/manage/
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
<!--Delete sections as needed -->
## Description
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Signed-off-by: aevesdocker <allie.sadler@docker.com>
## Summary
Replace `@sarahsanders-docker` with `@akristen` on accounts, admin,
billing, and subscription docs. Keep `@aevesdocker` as co-owner on
security, and add ownership for support and the platform release notes.
Co-authored-by: Cursor <cursoragent@cursor.com>
## Description
Docker Desktop for Mac no longer starts a privileged helper process to
bind privileged ports (<1024) or cache the Registry Access Management
policy, and no longer shows a first-run installation window for
privileged access. This updates the docs accordingly:
- Removed the "Privileged helper" section (and the `vmnetd` example)
from `mac-permission-requirements.md`
- Removed the "Binding privileged ports" section and related
bullets/links
- Removed the "Securely caching the Registry Access Management policy"
bullet from both `mac-permission-requirements.md` and
`windows-permission-requirements.md`
- Removed the "Allow privileged port mapping" setting from
`settings.md`, and the matching mention in `mac-install.md`
- Reworded the intro of the Permission requirements section: privileged
access (CLI tools location, default Docker socket) is now managed from
the **Advanced** page in **Settings**, not granted via a first-run
install screen
- Updated "Installing symlinks": the default is now `$HOME/.docker/bin`,
automatically added to `PATH`; `/usr/local/bin` is an opt-in,
password-gated alternative from **Advanced** settings
- Updated the Advanced (Mac only) settings table to match: **System**
now notes "Requires password", **User** notes it's the default with
automatic PATH setup, and dropped the "set during initial install"
framing
## Related issues or tickets
[DKP-2730](https://docker.atlassian.net/browse/DKP-2730)
## Reviews
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
[DKP-2730]:
https://docker.atlassian.net/browse/DKP-2730?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
<!--Delete sections as needed -->
## Description
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Signed-off-by: aevesdocker <allie.sadler@docker.com>
The `infra.yaml` code block under Step 6 (Structure your project with
multiple Compose files) was nested inside an ordered list, which left
stray leading whitespace on `services:` and `volumes:`. When users
copy-paste the example verbatim, `docker compose` fails with:
go-yaml load error in parser at L13.C1: did not find expected <document
start>
This change aligns the YAML with the standard 0/2/4-space indent used
elsewhere in the tutorial, and also normalizes the leading whitespace of
the surrounding code fence.
<!--Delete sections as needed -->
## Description
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
While reading this page, I noticed "1)" renders as a bullet point while
"2)" stays inline mid-sentence:
> This was made possible because
> 1. the processes running in each container are watching and responding
to
> file changes and 2) the files in your local project directory are
shared
> ...
Checked the file history with `git log -L` — the original text used `1)`
and `2)` symmetrically as an inline parenthetical enumeration, all on
one line. A later commit addressing #24394 (clarifying where the files
are located) expanded the paragraph and reflowed it across multiple
lines, which put `1)` at the start of a line. Per the [CommonMark
spec](https://spec.commonmark.org/0.31.2/#ordered-list-marker), both `.`
and `)` after a digit at the start of a line are valid ordered-list
markers — so `1)` now renders as an actual list item, while `2)`, still
mid-line, stays as plain text. Inconsistent and presumably unintended.
This PR restores the sentence to a single paragraph (matching the
pre-#24394 formatting), keeping the additional clarifying text that
#24394 added. Verified in a local Markdown preview that it now renders
as plain prose with no stray list item.
The local cache example used a Move cache step to work around the cache
directory growing on every run, citing moby/buildkit#1896. That issue is
closed: moby/buildkit#6612 added a reset attribute to the local cache
exporter, and Buildx v0.35.0 is the first release to carry it.
Export to the cache directory directly with reset=true instead. Measured
over five runs exporting to the same directory: without reset the store
grew from 5 to 21 blobs, with reset it stayed at 5, and importing from
it on a fresh builder still hit the cache.
The callout is now a note rather than a warning, since the growth has a
supported fix.
Signed-off-by: Sunmin Lee <134378502+sunm2n@users.noreply.github.com>
The local cache exporter accepts reset=true, which deletes blobs that no
tag in the cache directory references. Blobs referenced by other tags are
kept, and manifests that no tag references can no longer be imported by
digest.
Added in moby/buildkit#6612, which changes the client only. The gate is
therefore the Buildx version rather than the BuildKit daemon version:
Buildx v0.35.0 is the first release to vendor moby/buildkit v0.31.0.
Fixes#25959
Signed-off-by: Sunmin Lee <134378502+sunm2n@users.noreply.github.com>
## Summary
Documents which Docker Hub API endpoints accept org access token (OAT)
authentication, and the scope-dependent listing behavior for repository
listing.
### Changes
- **`content/reference/api/hub/latest.yaml`**: Added `<span
class="oat"></span>` markers to 11 repository endpoint groups under
`/v2/namespaces/{namespace}/repositories/`. Includes a note on
scope-based listing behavior for `GET
/v2/namespaces/{namespace}/repositories`.
- **`content/manuals/enterprise/security/access-tokens.md`**: New "Hub
API support" section covering supported endpoint categories and the
`scope-repository-list` listing behavior.
### OAT listing behavior
`GET /v2/namespaces/{namespace}/repositories`:
- OAT **with** `scope-repository-list` → returns all repos including
private
- OAT **without** that scope → returns only public repos
## Test plan
- [ ] Preview site renders `<span class="oat">` badge on repo endpoints
- [ ] Hub API support section appears correctly in access-tokens manual
page
- [ ] Listing behavior note is clear and accurate
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Alexa Kristensen <81787716+akristen@users.noreply.github.com>
Direct mounts authorize workspace access by path, so hard-linked files can expose writes outside the authorized root. Document the behavior and explain that clone mode mounts the primary host repository read-only.
Refs docker/sandboxes#4715
Co-Authored-By: Claude <noreply@anthropic.com>
The Agentic Platform docs did not list all credentials supported by the Secrets page. Add Groq and xAI to the provider references and record the update in the release notes.
Co-Authored-By: Codex <noreply@openai.com>
