Permissions

Permissions are rules on a group: for each action, Allow or Deny. No Rule leaves the action to a broader rule, such as one for the whole environment; without any rule, it is denied. A new account can do nothing until it is in a group or has overrides. The owner can always do everything.

Give permissionsCopy Anchor Link

1. Open Access → Groups, then a group.
2. In the tree on the left, pick where the rules apply:
   • All Resources: everything, including environments you add later,
   • one environment, with everything on it,
   • or one stack, stack service, container, volume, template and so on.
3. Pick a preset under Start From, or set single actions. Each action names what it acts on, such as Restart Containers. Risky actions are marked High Risk; rarely needed ones are folded away at the end of each section.
4. To check the result first, press Preview as a Member: it shows what a member of only this group may do with your changes, saved or not, and why.
5. Press Save Permissions and confirm the list of changes.

The presets:

• Viewer: sees everything, changes nothing. Logs, files and secrets stay hidden.
• Operator: also deploys, starts, stops, brings down, restarts and recreates, pulls images, checks for image updates, runs backups, reads logs and dismisses alerts. Stop keeps a stack's containers; bringing a stack down removes them but keeps its data. Nothing else is deleted, and no settings change.
• Admin: can do everything in that place, except what only the owner can do.

Within a group, the most specific rule decides: a rule on one stack wins over its environment, which wins over All Resources.

Start Stacks, Stop Stacks and Restart Stacks can also be given on one service of a stack, under the stack in the tree. Starting a service also starts the services it depends on, and restarting one restarts the services set to restart with it. The rule must cover those too.

For someone in several groups, the groups are checked from the top of the Groups list: the first group with a rule for the action decides, even if a lower group has a more specific rule. Drag the groups to change their order.

Rules for one personCopy Anchor Link

Open a person under Access to set Overrides: rules for just them, which win over the rules of all their groups. Effective Access shows what they may do in the end; its Why column names the group or override that decides and where its rule applies, such as Allowed by the group “Ops” on homelab. View as This User checks their access again; with unsaved overrides, the button reads Preview with Unsaved Changes.

What only the owner can doCopy Anchor Link

Some things can't be given to anyone else: managing people, groups and the sign-in policy, other people's API tokens, registry connections and Git credentials, notification channels, alert thresholds, template sources, backing up, restoring and moving Docker Manager itself, and the support bundle.