Hi,

There is the website http://harbormaster.io/docs/ which is not complete and not up to date. I'm working on updating it.

To add a policy you need to have 2 elements, a group and a collection. By default, all Docker commands and restricted parameters are allowed. To change that behavior, an option needs to be set to true, then all commands will be blocked and so need to be white-listed.

hbm config set authorization true

First create an user and group. If Docker Daemon is listening on Unix socket, the only user will be root.

hbm group add local
hbm user add root
hbm user member --add local root

Then create a collection to which resources will be assigned to. Resources could be anything from Docker commands to images, volumes, restricted parameters like --privileged; --net=host and so on... A list of types and values can be found on that page.

hbm collection add collection1
hbm resource add --type action --value info info
hbm resource add --type action --value version version
hbm resource member --add collection1 info
hbm resource member --add collection1 version

To finish create the policy.

hbm policy add --group local --collection collection1 policy1

Let me know if you have any questions.

Thanks

Documentation for Adding Policies #10

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions