All Docker and Docker Swarm resources (except images) deployed through Portainer have access control settings. You can set these when resources are deployed or at a later time. Resources deployed through a stack or a service will inherit the same access as the parent.
This is an example access control section, showing access control enabled. With these settings, only Portainer administrators will have access to the resource and any other resources created by it (for example, a stack that creates containers, services, volumes, networks and secrets).
This is an example access control section showing access control disabled. All Portainer users will have access to the resource and any resources created by it.
This is an example access control section showing access control enabled in Restricted mode. After you select the Restricted option, you can select more teams and users and give them access to the resource.
Any resources deployed to Docker or Docker Swarm outside of Portainer will be marked as external and you will have limited control over these resources. By default, these resources will have administrator-only access, but you can enable access control using these labels (examples used, swap out for your own parameters):
| Label | Access Granted |
|---|---|
| All Portainer users have access to the resource. Takes precedence over team/user assignments. |
| Access restricted to teams |
| Access is restricted to users |
Deploy a stack using Docker Compose and restrict access to teams dev and prod:
Deploy a stack using the Docker CLI and restrict access to team testers and users bob and adam:
Deploy a container using the Docker CLI and make it accessible to all Portainer users:
Deploy a container using the Docker CLI and restrict access to teams dev and prod and users bob:
