docker
Org Allow List Curation for Desktop Extensions
Tell us about your request Extensions can integrate with services external to our organization that could pose a security risk without some analysis by the Organization. Providing an allowList enforced by Docker Desktop similar to Chromium Extensions offers us the opportunity to vet the functionality before allowing associates to install.
Which service(s) is this request for? Docker Extensions w Business License
Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard? Installing things off the marketplace could lead to unplanned data leakage and more difficult discussions and less flexible controls
Are you currently working around the issue? Extensions is new, but trying to avoid coarse grain controls to try and mitigate risk
Additional context Ideally it should have a "requested" status that notifies Org owners of a marketplace request and allows them to evaluate the Extension and add to allowList if appropriate. That should either install on next Desktop launch or notify Desktop user of status change. You could also add metadata like allowed and denied that could adjust the available extensions view.
@byjrack Thank you for the suggestion. We haven't started looking at Business specific features for extensions yet, but have plans for them in the future. We'll add this to the list of ideas we are investigating.
Yup given some of the more recent issues with Marketplace apps providing an indirect route into private Orgs through functionality or access there is a more heightened sensitivity to what could happen. A review process can't eliminate those threats since extensions change and use cases as well, but some governance gives us one lever to try and manage them. And ideally pull the plug if something unexpected arises.
Hi everyone - PM of Extensions here :)
We are actively investigating a solution for this now. If you have any additional feedback we would love to hear it!
No real details beyond what was there.
Similar workflow could be seen with Github Actions controls for Org admins
https://docs.github.com/en/enterprise-cloud@latest/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#allowing-select-actions-and-reusable-workflows-to-run
The allow list is currently a bit less ideal, but possibly a model similar to https://docs.github.com/en/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization
And I think this will be less popular than just a simple allow list, but having mandatory extensions for Org members might be nice. Let's say an Org authors their own extension and puts it in their Org as a private repo could you set that as mandatory so that all new Org members get it.
Maybe something akin to https://support.google.com/chrome/a/answer/9867568?hl=en and how Chrome allows admins to curate.