Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add documentation for Configuration Profiles #21073

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
+82 −0
Open

Add documentation for Configuration Profiles #21073

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
82 changes: 82 additions & 0 deletions content/manuals/security/for-admins/enforce-sign-in/methods.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,88 @@
7. Test the GPO. Test the GPO on a small set of machines first to ensure it behaves as expected. You can use the `gpupdate /force` command on a test machine to manually refresh its group policy settings and check the registry to confirm the changes.
8. Once verified, you can proceed with broader deployment. Monitor the deployment to ensure the settings are applied correctly across the organization's computers.

## Configuration Profiles method (Mac only)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
## Configuration Profiles method (Mac only)
## Configuration profiles method (Mac only)


> [!NOTE]
>
> The configuration profiles method is available with Docker Desktop version 4.35 and later.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@KatTomrushka keep me honest here - won't this be announced in 4.36? so we should align here too to keep consistent? Also is it EA or straight to GA?

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Correct, 4.35 is coming out on 10 Oct (although might well be delayed). The macOS config profiles along with the PKG installer are aimed for 4.36 which is the earliest possible release to get proper Customer 0 and product readiness.
In addition, as all other enterprise enablement features, it would be EAP first not straight to GA.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok perfecto, thank you!

@aheck Let's change this to The configuration profiles method is in [Early Access](/manuals/release-lifecycle.md) and is available with Docker Desktop version 4.36 and later.


Configuration Profiles are a feature of macOS that allows administrators to distribute

Check warning on line 56 in content/manuals/security/for-admins/enforce-sign-in/methods.md

View workflow job for this annotation

GitHub Actions / vale 

[vale] reported by reviewdog 🐶
[Docker.RecommendedWords] Consider using 'lets' instead of 'allows'

Raw Output:
{"message": "[Docker.RecommendedWords] Consider using 'lets' instead of 'allows'", "location": {"path": "content/manuals/security/for-admins/enforce-sign-in/methods.md", "range": {"start": {"line": 56, "column": 52}}}, "severity": "INFO"}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Configuration Profiles are a feature of macOS that allows administrators to distribute
Configuration profiles are a feature of macOS that let administrators distribute

configuration information to the Macs they manage. Is is the safest method to
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
configuration information to the Macs they manage. Is is the safest method to
configuration information to the Macs they manage. It is the safest method to

enforce sign-in on macOS because the installed configuration profiles are
protected by Apples' System Integrity Protection (SIP) and can therefore not be
tampered with by the users.

1. Save the the following XML code to a file with the suffix `.mobileconfig` (e.g.

Check failure on line 62 in content/manuals/security/for-admins/enforce-sign-in/methods.md

View workflow job for this annotation

GitHub Actions / vale 

[vale] reported by reviewdog 🐶
[Vale.Repetition] 'the' is repeated!

Raw Output:
{"message": "[Vale.Repetition] 'the' is repeated!", "location": {"path": "content/manuals/security/for-admins/enforce-sign-in/methods.md", "range": {"start": {"line": 62, "column": 9}}}, "severity": "ERROR"}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
1. Save the the following XML code to a file with the suffix `.mobileconfig` (e.g.
1. Save the the following XML code to a file with the suffix `.mobileconfig`, for example

`docker.mobileconfig`):
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
`docker.mobileconfig`):
`docker.mobileconfig`:



```xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>PayloadContent</key>
<array>
<dict>
<key>PayloadType</key>
<string>com.docker.config</string>
<key>PayloadVersion</key>
<integer>1</integer>
<key>PayloadIdentifier</key>
<string>com.docker.config</string>
<key>PayloadUUID</key>
<string>eed295b0-a650-40b0-9dda-90efb12be3c7</string>
<key>PayloadDisplayName</key>
<string>Docker Desktop Configuration</string>
<key>PayloadDescription</key>
<string>Configuration profile to manage Docker Desktop settings.</string>
<key>PayloadOrganization</key>
<string>Your Company Name</string>
<key>allowedOrgs</key>
<string>first_org;second_org</string>
</dict>
</array>
<key>PayloadType</key>
<string>Configuration</string>
<key>PayloadVersion</key>
<integer>1</integer>
<key>PayloadIdentifier</key>
<string>com.yourcompany.docker.config</string>
<key>PayloadUUID</key>
<string>0deedb64-7dc9-46e5-b6bf-69d64a9561ce</string>
<key>PayloadDisplayName</key>
<string>Docker Desktop Config Profile</string>
<key>PayloadDescription</key>
<string>Config profile to enforce Docker Desktop settings for allowed organizations.</string>
<key>PayloadOrganization</key>
<string>Your Company Name</string>
</dict>
</plist>
```

2. Change the placeholder `Your Company Name` to the name of your company.

3. The names of the allowed organizations are stored in the `allowedOrgs`
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
3. The names of the allowed organizations are stored in the `allowedOrgs`
3. Add your organization name. The names of the allowed organizations are stored in the `allowedOrgs`

property. It can contain either the name of a single organization

```xml
<key>allowedOrgs</key>
<string>yourcompany</string>
```

or a list of organization names, separated by semicolon:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd move this up to line 113, I wouldn't split it and I've just show the multi-org example for simplicity.



```xml
<key>allowedOrgs</key>
<string>first_org;second_org</string>
```

4. Use a MDM solution to distribute your modified `.mobileconfig` file to your

Check warning on line 128 in content/manuals/security/for-admins/enforce-sign-in/methods.md

View workflow job for this annotation

GitHub Actions / vale 

[vale] reported by reviewdog 🐶
[Docker.Acronyms] 'MDM' has no definition.

Raw Output:
{"message": "[Docker.Acronyms] 'MDM' has no definition.", "location": {"path": "content/manuals/security/for-admins/enforce-sign-in/methods.md", "range": {"start": {"line": 128, "column": 10}}}, "severity": "WARNING"}
macOS clients. Sign-in is now enforced on all of those devices.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
macOS clients. Sign-in is now enforced on all of those devices.
macOS clients.
Sign-in is now enforced on all of those devices.



## plist method (Mac only)

> [!NOTE]
Expand Down
Loading