diff --git a/content/manuals/enterprise/security/hardened-desktop/settings-management/configure-json-file.md b/content/manuals/enterprise/security/hardened-desktop/settings-management/configure-json-file.md index 9b342e9002f7..5bd4968c21a0 100644 --- a/content/manuals/enterprise/security/hardened-desktop/settings-management/configure-json-file.md +++ b/content/manuals/enterprise/security/hardened-desktop/settings-management/configure-json-file.md @@ -280,13 +280,21 @@ The following tables describe all available settings in the `admin-settings.json |`configurationFileVersion`| |Specifies the version of the configuration file format.| | |`analyticsEnabled`| |If `value` is set to false, Docker Desktop doesn't send usage statistics to Docker. | | |`disableUpdate`| |If `value` is set to true, checking for and notifications about Docker Desktop updates is disabled.| | -|`extensionsEnabled`| |If `value` is set to false, Docker extensions are disabled. | | | `blockDockerLoad` | | If `value` is set to `true`, users are no longer able to run [`docker load`](/reference/cli/docker/image/load/) and receive an error if they try to.| | | `displayedOnboarding` | | If `value` is set to `true`, the onboarding survey will not be displayed to new users. Setting `value` to `false` has no effect. | Docker Desktop version 4.30 and later | | `desktopTerminalEnabled` | | If `value` is set to `false`, developers cannot use the Docker terminal to interact with the host machine and execute commands directly from Docker Desktop. | | |`exposeDockerAPIOnTCP2375`| Windows only| Exposes the Docker API on a specified port. If `value` is set to true, the Docker API is exposed on port 2375. Note: This is unauthenticated and should only be enabled if protected by suitable firewall rules.| | | `silentModulesUpdate` | | If `value` is set to `true`, Docker Desktop automatically updates components that don't require a restart. For example, the Docker CLI or Docker Scout components. | Docker Desktop version 4.46 and later. | +### Extensions + +|Parameter|OS|Description|Version| +|:-------------------------------|---|:-------------------------------|---| +|`extensionsEnabled`| |If `value` is set to false, Docker Extensions are disabled. | | +| `onlyMarketplaceExtensions` | | If `value` is set to true, developers are blocked from installing other extensions via the command line.| | +| `extensionsPrivateMarketplace` | | If `value` is set to true, activates the private marketplace is enabled which ensures Docker Desktop connects to content defined and controlled by the administrator instead of the public Docker marketplace. | | +| `extensionsPrivateMarketplaceAdminContactURL` | | Defines a contact link for developers to request new extensions in the private marketplace. | | + ### File sharing and emulation |Parameter|OS|Description|Version| diff --git a/content/manuals/enterprise/security/hardened-desktop/settings-management/settings-reference.md b/content/manuals/enterprise/security/hardened-desktop/settings-management/settings-reference.md index fbfc78d24dc6..b4fe87784cbf 100644 --- a/content/manuals/enterprise/security/hardened-desktop/settings-management/settings-reference.md +++ b/content/manuals/enterprise/security/hardened-desktop/settings-management/settings-reference.md @@ -839,13 +839,28 @@ third-party or unvetted plugins from being installed. | Default value | Accepted values | Format | |---------------|-----------------|----------| -| `true` | `true`, `false` | Boolean | +| `false` | `true`, `false` | Boolean | - **Description:** Restriction of Docker Extensions to only those available through the official marketplace. - **OS:** {{< badge color=blue text="All" >}} - **Use case:** Prevent installation of third-party or locally developed extensions. - **Configure this setting with:** - **Extensions** settings in [Docker Desktop GUI](/manuals/desktop/settings-and-maintenance/settings.md) + - Settings Management: `onlyMarketplaceExtensions` setting in the [`admin-settings.json` file](/manuals/enterprise/security/hardened-desktop/settings-management/configure-json-file.md) + - Settings Management: **Only marketplace extensions** setting in the [Admin Console](/manuals/enterprise/security/hardened-desktop/settings-management/configure-admin-console.md) + +### Enable a private marketplace + +| Default value | Accepted values | Format | +|---------------|-----------------|----------| +| `false` | `true`, `false` | Boolean | + +- **Description:** Activates the private marketplace. +- **OS:** {{< badge color=blue text="All" >}} +- **Use case:** Ensures Docker Desktop connects to content defined and controlled by the administrator instead of the public Docker marketplace. +- **Configure this setting with:** + - Settings Management: `extensionsPrivateMarketplace` setting in the [`admin-settings.json` file](/manuals/enterprise/security/hardened-desktop/settings-management/configure-json-file.md) + - Settings Management: **Extensions private marketplace** setting in the [Admin Console](/manuals/enterprise/security/hardened-desktop/settings-management/configure-admin-console.md) ### Show Docker Extensions system containers diff --git a/content/manuals/extensions/private-marketplace.md b/content/manuals/extensions/private-marketplace.md index a828d160dd58..dd69c1935ea2 100644 --- a/content/manuals/extensions/private-marketplace.md +++ b/content/manuals/extensions/private-marketplace.md @@ -61,10 +61,18 @@ This creates 2 files: - `admin-settings.json`, which activates the private marketplace feature once it’s applied to Docker Desktop on your developers’ machines. - `extensions.txt`, which determines which extensions to list in your private marketplace. +> [!IMPORTANT] +> +> If your org is using [Settings Management](/manuals/enterprise/security/hardened-desktop/settings-management/_index.md) via the [Admin Console](manuals/enterprise/security/hardened-desktop/settings-management/configure-admin-console/_index.md), you will not need the `admins-settings.json` file. Delete the generated file and keep only the `extensions.txt` file. + ## Step two: Set the behaviour The generated `admin-settings.json` file includes various settings you can modify. +> [!IMPORTANT] +> +> If your org is managing settings via the [Admin Console](manuals/enterprise/security/hardened-desktop/settings-management/configure-admin-console/_index.md), you will define the same settings in the Admin Console instead of the `admin-settings.json` file. + Each setting has a `value` that you can set, including a `locked` field that lets you lock the setting and make it unchangeable by your developers. - `extensionsEnabled` enables Docker Extensions. @@ -174,6 +182,10 @@ It's recommended that you try the private marketplace on your Docker Desktop ins 2. Quit and re-open Docker Desktop. 3. Sign in with a Docker account. +> [!IMPORTANT] +> +> > If your org is managing settings via the [Admin Console](manuals/enterprise/security/hardened-desktop/settings-management/configure-admin-console/_index.md), with Docker Desktop version 4.59 and earlier you need to manually delete the `admin-settings.json` file that has been created in the target folder by the `apply` command before step 2. + When you select the **Extensions** tab, you should see the private marketplace listing only the extensions you have allowed in `extensions.txt`. ![Extensions Private Marketplace](/assets/images/extensions-private-marketplace.webp) @@ -183,7 +195,7 @@ When you select the **Extensions** tab, you should see the private marketplace l Once you’ve confirmed that the private marketplace configuration works, the final step is to distribute the files to the developers’ machines with the MDM software your organization uses. For example, [Jamf](https://www.jamf.com/). The files to distribute are: -* `admin-settings.json` +* `admin-settings.json` (except if your org is managing settings via the [Admin Console](manuals/enterprise/security/hardened-desktop/settings-management/configure-admin-console/_index.md)) * the entire `extension-marketplace` folder and its subfolders These files must be placed on developer's machines. Depending on your operating system, the target location is (as mentioned above):