Docker roles and permissions

This document describes the permission levels each RBAC role has within the Portainer application for both Docker Standalone and Docker Swarm environments. Refer to the linked notes for further requirements on each operation.

{% hint style="info" %} Role-Based Access Control is only available in Portainer Business Edition. {% endhint %}

Legend

<table><thead><tr><th width="145">Abbreviation</th><th>Role name</th></tr></thead><tbody><tr><td>EA</td><td>Environment Administrator</td></tr><tr><td>OP</td><td>Operator</td></tr><tr><td>HD</td><td>Helpdesk</td></tr><tr><td>ST</td><td>Standard user</td></tr><tr><td>RO</td><td>Read-only user</td></tr></tbody></table>

Roles and permissions

Templates

<table><thead><tr><th width="352">Operation</th><th width="62" data-type="checkbox">EA</th><th width="58" data-type="checkbox">OP</th><th width="58" data-type="checkbox">HD</th><th width="55" data-type="checkbox">ST</th><th width="58" data-type="checkbox">RO</th><th>Notes</th></tr></thead><tbody><tr><td>View app templates</td><td>true</td><td>true</td><td>true</td><td>true</td><td>true</td><td></td></tr><tr><td>Deploy app templates</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td></td></tr><tr><td>View custom templates</td><td>true</td><td>true</td><td>true</td><td>true</td><td>true</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>Create custom templates</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td></td></tr><tr><td>Deploy custom templates</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>Edit custom templates</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>Change custom template ownership</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>Delete custom template</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr></tbody></table>

Stacks

Access to these operations can be affected by the Disable the use of Stacks for non-administrators security setting (Docker, Swarm).

<table><thead><tr><th width="352">Operation</th><th width="62" data-type="checkbox">EA</th><th width="58" data-type="checkbox">OP</th><th width="57" data-type="checkbox">HD</th><th width="55" data-type="checkbox">ST</th><th width="58" data-type="checkbox">RO</th><th>Notes</th></tr></thead><tbody><tr><td>View stacks</td><td>true</td><td>true</td><td>true</td><td>true</td><td>true</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>Create a stack</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">3</a></td></tr><tr><td>Edit a stack</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>View stack details</td><td>true</td><td>true</td><td>true</td><td>true</td><td>true</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>Change stack ownership</td><td>true</td><td>true</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>Stop a stack</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>Start a stack</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>Duplicate a stack</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>Migrate a stack</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>Create template from a stack</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>Update service in stack</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">1</a>, <a href="docker-roles-and-permissions.md#notes">2</a></td></tr><tr><td>Remove service from stack</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">1</a>, <a href="docker-roles-and-permissions.md#notes">2</a></td></tr><tr><td>Delete a stack</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr></tbody></table>

Services

These operations are only relevant for Docker Swarm environments.

<table><thead><tr><th width="352">Operation</th><th width="62" data-type="checkbox">EA</th><th width="58" data-type="checkbox">OP</th><th width="58" data-type="checkbox">HD</th><th width="55" data-type="checkbox">ST</th><th width="58" data-type="checkbox">RO</th><th>Notes</th></tr></thead><tbody><tr><td>View services</td><td>true</td><td>true</td><td>true</td><td>true</td><td>true</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>Create service</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">3.5</a></td></tr><tr><td>View service details</td><td>true</td><td>true</td><td>true</td><td>true</td><td>true</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>Edit service</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">1</a>, <a href="docker-roles-and-permissions.md#notes">3.5</a></td></tr><tr><td>Update service</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>Roll back service</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>View service logs</td><td>true</td><td>true</td><td>true</td><td>true</td><td>true</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>Change service ownership</td><td>true</td><td>true</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>Delete service</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr></tbody></table>

Containers

<table><thead><tr><th width="352">Operation</th><th width="62" data-type="checkbox">EA</th><th width="58" data-type="checkbox">OP</th><th width="59" data-type="checkbox">HD</th><th width="55" data-type="checkbox">ST</th><th width="58" data-type="checkbox">RO</th><th>Notes</th></tr></thead><tbody><tr><td>View containers</td><td>true</td><td>true</td><td>true</td><td>true</td><td>true</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>Create container</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">3</a></td></tr><tr><td>Build an image from a container</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>View container details</td><td>true</td><td>true</td><td>true</td><td>true</td><td>true</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>Start container</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>Stop container</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>Kill container</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>Restart container</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>Pause container</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>Resume container</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>Edit container</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">1</a>, <a href="docker-roles-and-permissions.md#notes">3</a></td></tr><tr><td>Duplicate container</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">1</a>, <a href="docker-roles-and-permissions.md#notes">3</a></td></tr><tr><td>Recreate container</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">1</a>, <a href="docker-roles-and-permissions.md#notes">3</a></td></tr><tr><td>Container console</td><td>true</td><td>true</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>Container attach</td><td>true</td><td>true</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>Join container to network</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>Remove container from network</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>View container logs</td><td>true</td><td>true</td><td>true</td><td>true</td><td>true</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>Change container ownership</td><td>true</td><td>true</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>Delete container</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr></tbody></table>

Images

<table><thead><tr><th width="352">Operation</th><th width="62" data-type="checkbox">EA</th><th width="58" data-type="checkbox">OP</th><th width="58" data-type="checkbox">HD</th><th width="55" data-type="checkbox">ST</th><th width="58" data-type="checkbox">RO</th><th>Notes</th></tr></thead><tbody><tr><td>View images</td><td>true</td><td>true</td><td>true</td><td>true</td><td>true</td><td></td></tr><tr><td>Pull an image</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td></td></tr><tr><td>Push an image</td><td>true</td><td>false</td><td>false</td><td>false</td><td>false</td><td></td></tr><tr><td>Build an image</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td></td></tr><tr><td>Import an image</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td></td></tr><tr><td>View image details</td><td>true</td><td>true</td><td>true</td><td>true</td><td>true</td><td></td></tr><tr><td>Add tag to image</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td></td></tr><tr><td>Remove tag from image</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td></td></tr><tr><td>Export image</td><td>true</td><td>false</td><td>false</td><td>false</td><td>false</td><td></td></tr><tr><td>Delete an image</td><td>true</td><td>false</td><td>false</td><td>false</td><td>false</td><td></td></tr></tbody></table>

Volumes

<table><thead><tr><th width="352">Operation</th><th width="62" data-type="checkbox">EA</th><th width="58" data-type="checkbox">OP</th><th width="58" data-type="checkbox">HD</th><th width="55" data-type="checkbox">ST</th><th width="58" data-type="checkbox">RO</th><th>Notes</th></tr></thead><tbody><tr><td>View volumes</td><td>true</td><td>true</td><td>true</td><td>true</td><td>true</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>Create a volume</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td></td></tr><tr><td>View volume details</td><td>true</td><td>true</td><td>true</td><td>true</td><td>true</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>Browse a volume</td><td>true</td><td>true</td><td>true</td><td>true</td><td>true</td><td><a href="docker-roles-and-permissions.md#notes">1</a>, <a href="docker-roles-and-permissions.md#notes">4</a></td></tr><tr><td>Change volume ownership</td><td>true</td><td>true</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>Delete a volume</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr></tbody></table>

Networks

<table><thead><tr><th width="352">Operation</th><th width="62" data-type="checkbox">EA</th><th width="58" data-type="checkbox">OP</th><th width="58" data-type="checkbox">HD</th><th width="55" data-type="checkbox">ST</th><th width="58" data-type="checkbox">RO</th><th>Notes</th></tr></thead><tbody><tr><td>View networks</td><td>true</td><td>true</td><td>true</td><td>true</td><td>true</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>Create a network</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td></td></tr><tr><td>View network details</td><td>true</td><td>true</td><td>true</td><td>true</td><td>true</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>Change network ownership</td><td>true</td><td>true</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>Delete a network</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr></tbody></table>

Events

These operations are only relevant for Docker Standalone environments.

<table><thead><tr><th width="352">Operation</th><th width="62" data-type="checkbox">EA</th><th width="58" data-type="checkbox">OP</th><th width="57" data-type="checkbox">HD</th><th width="55" data-type="checkbox">ST</th><th width="58" data-type="checkbox">RO</th><th>Notes</th></tr></thead><tbody><tr><td>View events</td><td>false</td><td>false</td><td>false</td><td>false</td><td>false</td><td></td></tr></tbody></table>

Configs

These operations are only relevant for Docker Swarm environments.

<table><thead><tr><th width="352">Operation</th><th width="62" data-type="checkbox">EA</th><th width="58" data-type="checkbox">OP</th><th width="57" data-type="checkbox">HD</th><th width="55" data-type="checkbox">ST</th><th width="58" data-type="checkbox">RO</th><th>Notes</th></tr></thead><tbody><tr><td>View configs</td><td>true</td><td>true</td><td>true</td><td>true</td><td>true</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>Create a config</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td></td></tr><tr><td>View config details</td><td>true</td><td>true</td><td>true</td><td>true</td><td>true</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>Clone a config</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>Change config ownership</td><td>true</td><td>true</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>Delete a config</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr></tbody></table>

Secrets

These operations are only relevant for Docker Swarm environments.

<table><thead><tr><th width="352">Operation</th><th width="62" data-type="checkbox">EA</th><th width="58" data-type="checkbox">OP</th><th width="58" data-type="checkbox">HD</th><th width="55" data-type="checkbox">ST</th><th width="58" data-type="checkbox">RO</th><th>Notes</th></tr></thead><tbody><tr><td>View secrets</td><td>true</td><td>true</td><td>true</td><td>true</td><td>true</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>Create a secret</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td></td></tr><tr><td>View secret details</td><td>true</td><td>true</td><td>true</td><td>true</td><td>true</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>Change secret ownership</td><td>true</td><td>true</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>Delete a secret</td><td>true</td><td>false</td><td>false</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr></tbody></table>

Host

These operations are only relevant for Docker Standalone environments.

<table><thead><tr><th width="352">Operation</th><th width="62" data-type="checkbox">EA</th><th width="58" data-type="checkbox">OP</th><th width="58" data-type="checkbox">HD</th><th width="55" data-type="checkbox">ST</th><th width="58" data-type="checkbox">RO</th><th>Notes</th></tr></thead><tbody><tr><td>View host details</td><td>true</td><td>true</td><td>true</td><td>true</td><td>true</td><td></td></tr></tbody></table>

Swarm

These operations are only relevant for Docker Swarm environments.

<table><thead><tr><th width="352">Operation</th><th width="62" data-type="checkbox">EA</th><th width="58" data-type="checkbox">OP</th><th width="58" data-type="checkbox">HD</th><th width="55" data-type="checkbox">ST</th><th width="58" data-type="checkbox">RO</th><th>Notes</th></tr></thead><tbody><tr><td>View cluster details</td><td>true</td><td>true</td><td>true</td><td>true</td><td>true</td><td></td></tr></tbody></table>

Registries

<table><thead><tr><th width="352">Operation</th><th width="62" data-type="checkbox">EA</th><th width="58" data-type="checkbox">OP</th><th width="58" data-type="checkbox">HD</th><th width="55" data-type="checkbox">ST</th><th width="58" data-type="checkbox">RO</th><th>Notes</th></tr></thead><tbody><tr><td>Read registry</td><td>true</td><td>true</td><td>true</td><td>true</td><td>true</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>Browse registry</td><td>true</td><td>true</td><td>true</td><td>true</td><td>true</td><td><a href="docker-roles-and-permissions.md#notes">1</a></td></tr><tr><td>Update repositories</td><td>true</td><td>true</td><td>true</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">5</a></td></tr><tr><td>Delete repositories</td><td>true</td><td>true</td><td>true</td><td>true</td><td>false</td><td><a href="docker-roles-and-permissions.md#notes">5</a></td></tr></tbody></table>

Notes

1. Standard / Read only users (and Operators in the case of ownership operations) have permission only if they are given access to the resource. This can be inherited, for example inheriting a service from a stack.
2. This operation is only relevant for Swarm environments.
3. This operation can be affected by the following security settings (Docker, Swarm):
   1. Disable privileged mode for non-administrators
   2. Disable the use of host PID 1 for non-administrators
   3. Disable device mappings for non-administrators
   4. Disable container capabilities for non-administrators
   5. Disable bind mounts for non-administrators
4. This operation can be affected by the Enable volume management for non-administrators setting (Docker, Swarm), and requires the use of the Portainer Agent.
5. This operation can only be performed under the allowed registry.