From 6d6acdbc0be1b9e42beb7eb564e1e4e9edbaeaf3 Mon Sep 17 00:00:00 2001 From: mbecker20 Date: Fri, 30 May 2025 16:49:27 -0400 Subject: [PATCH] fix permissions list --- docsite/docs/permissioning.md | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/docsite/docs/permissioning.md b/docsite/docs/permissioning.md index c5dfbc842..bdea736ac 100644 --- a/docsite/docs/permissioning.md +++ b/docsite/docs/permissioning.md @@ -28,18 +28,18 @@ There are 4 permission levels a user / group can be given on a Resource: Permission levels alone are not quite enough to provide granular access control. Some features are additionally gated behind a specific permission for that feature. -- `Terminal`: User can access the associated resource's terminal. - - If given on a `Server`, this allows server level terminal access. - - If given on a `Stack` or `Deployment`, this allows container exec terminal (even without `Terminal` on `Server`) -- `Attach`: User can "attach" *other resources* to the resource. - - If given on a `Server`, allows users to attach `Stacks` and `Deployments` - - If given on a `Builder`, allows users to attach `Builds` -- `DockerInspect`: User can "inspect" docker resources (like containers) on the `Server` - - Access to this api will expose all container environments on the given server, and can easily lead to secrets being leaked to unintended users if not protected. -- `DockerLogs`: User can retrieve docker / docker compose logs on the associated resource. +- **`Logs`**: User can retrieve docker / docker compose logs on the associated resource. - Valid on `Server`, `Stack`, `Deployment` - For admins wanting this permission by default for all users with read permissions, see below on default user groups. -- `ProcessList`: User can retrieve the full running process list on the `Server` +- **`Inspect`**: User can "inspect" docker resources (like containers) on the `Server` + - Access to this api will expose all container environments on the given server, and can easily lead to secrets being leaked to unintended users if not protected. +- **`Terminal`**: User can access the associated resource's terminal. + - If given on a `Server`, this allows server level terminal access. + - If given on a `Stack` or `Deployment`, this allows container exec terminal (even without `Terminal` on `Server`) +- **`Attach`**: User can "attach" *other resources* to the resource. + - If given on a `Server`, allows users to attach `Stacks` and `Deployments` + - If given on a `Builder`, allows users to attach `Builds` +- **`Processes`**: User can retrieve the full running process list on the `Server` ## Permissioning by Resource Type