Skip to content

security: update IAM/RAM docs for OATs compatibility #22915

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jun 25, 2025
Merged

security: update IAM/RAM docs for OATs compatibility #22915

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions content/manuals/security/for-admins/access-tokens.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,9 +10,10 @@ linkTitle: Organization access tokens

> [!WARNING]
>
> Organization access tokens (OATs) are incompatible with Docker Desktop.
> Organization access tokens (OATs) are incompatible with Docker Desktop,
> [Image Access Management (IAM)](/manuals/security/for-admins/hardened-desktop/image-access-management.md), and [Registry Access Management (RAM)](/manuals/security/for-admins/hardened-desktop/registry-access-management.md).
>
> If you use Docker Desktop, you must use personal
> If you use Docker Desktop, IAM, or RAM, you must use personal
> access tokens instead.

An organization access token (OAT) is like a [personal access token
Expand Down
4 changes: 4 additions & 0 deletions content/manuals/security/for-admins/hardened-desktop/image-access-management.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,10 @@ For example, a developer, who is part of an organization, building a new contain

You first need to [enforce sign-in](/manuals/security/for-admins/enforce-sign-in/_index.md) to ensure that all Docker Desktop developers authenticate with your organization. Since Image Access Management requires a Docker Business subscription, enforced sign-in guarantees that only authenticated users have access and that the feature consistently takes effect across all users, even though it may still work without enforced sign-in.

> [!IMPORTANT]
>
> You must use [personal access tokens (PATs)](/manuals/security/for-developers/access-tokens.md) with Image Access Management. Organization access tokens (OATs) are not compatible.

## Configure

{{< tabs >}}
Expand Down
4 changes: 4 additions & 0 deletions content/manuals/security/for-admins/hardened-desktop/registry-access-management.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,10 @@ always authenticate to your organization, even though they can authenticate
without it and the feature will take effect. Enforcing sign-in guarantees the
feature always takes effect.

> [!IMPORTANT]
>
> You must use [personal access tokens (PATs)](/manuals/security/for-developers/access-tokens.md) with Registry Access Management. Organization access tokens (OATs) are not compatible.

## Configure Registry Access Management permissions

{{< tabs >}}
Expand Down