starred/cli
1
0
Fork 0
mirror of https://github.com/docker/cli.git synced 2026-08-24 02:24:17 -05:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #6998 from mickael-docker/docs-clarify-authz

Browse Source 
docs: further clarify authz plugins
This commit is contained in:
Sebastiaan van Stijn
2026-05-21 09:52:08 +02:00
committed by GitHub
parent 79eb04c7d8 066d508bd3
commit 4494f1af5a
1 changed files with 8 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/extend/plugins_authorization.md
+8 -5
View File
@@ -74,11 +74,14 @@ The sequence diagrams below depict an allow and deny authorization flow:
Each request sent to the plugin includes the authenticated user, the HTTP
headers, and the request/response body. Only the user name and the
authentication method used are passed to the plugin. Most importantly, no user
credentials or tokens are passed. Finally, not all request/response bodies
are sent to the authorization plugin. Only request/response bodies where
the `Content-Type` is `application/json` are sent to the authorization plugin;
bodies of any other `Content-Type` are not visible to the plugin and cannot
be used for enforcement, even though the daemon may still act on this data.
credentials or tokens are passed.
> [!NOTE]
> Authorization plugins enforce requests to the Docker daemon's HTTP API only. gRPC method
> calls, whether dispatched natively or upgraded through `POST /grpc`, are not subject to authorization.
> Furthermore, HTTP request/response bodies where the `Content-Type` is `application/json` are forwarded;
> bodies of any other type are not visible to the plugin and cannot be used for enforcement,
> even though the daemon acts on this data.
For commands that can potentially hijack the HTTP connection (`HTTP
Upgrade`), such as `exec`, the authorization plugin is only called for the