The Universal Control Plane API is a REST API, available using HTTPS, that enables programmatic access to swarm resources that are managed by UCP. UCP exposes the full Docker Engine API, so you can extend your existing code with UCP features. The API is secured with role-based access control so that only authorized users can make changes and deploy applications to your Docker swarm.
The UCP API is accessible in the same IP addresses and domain names that you use to access the web UI. It's the same API that the UCP web UI uses, so everything you can do on the UCP web UI from your browser, you can also do programmatically.
The system manages swarm resources by using collections, which you access through the /collection endpoint. For example, GET /defaultCollection/<userid> retrieves the default collection for a user. Learn more about resource collections.
The /roles endpoint lets you enumerate and create custom permissions for accessing collections.
The /accounts endpoint enables managing users, teams, and organizations.
The /configs endpoint gives you access to the swarm's configuration.
List accountPublicKeys in an account. Lists accountPublicKeys in ascending order by key ID. Requires authentication and authorization as any user.
the ID of the account
,certificates for the public key
,the hash of the public key's DER bytes
,the label or description for the key
,the encoded PEM of the public key
Encoded PEM for the cert
,Label for the certificate
{
"accountPublicKeys": [
{
"accountID": "string",
"certificates": [
{
"cert": "string",
"label": "string"
}
],
"id": "string",
"label": "string",
"publicKey": "string"
}
]
}Create a public key for an account. Requires authentication and authorization as an admin user, the target user (if a user), or an admin member of the target organization (if an organization).
the ID of the account
,certificates for the public key
,the hash of the public key's DER bytes
,the label or description for the key
,the encoded PEM of the public key
Encoded PEM for the cert
,Label for the certificate
{
"accountID": "string",
"certificates": [
{
"cert": "string",
"label": "string"
}
],
"id": "string",
"label": "string",
"publicKey": "string"
}Remove an account public key. Requires authentication and authorization as an admin user, the target user (if a user), or an admin member of the target organization (if an organization).
Update details for an account public key. Requires authentication and authorization as an admin user, the target user (if a user), or an admin member of the target organization (if an organization).
the ID of the account
,certificates for the public key
,the hash of the public key's DER bytes
,the label or description for the key
,the encoded PEM of the public key
Encoded PEM for the cert
,Label for the certificate
{
"accountID": "string",
"certificates": [
{
"cert": "string",
"label": "string"
}
],
"id": "string",
"label": "string",
"publicKey": "string"
}List user and organization accounts. Lists information about user and organization accounts. Supports sorting and filtering. Requires authentication and authorization as any user.
Full Name of the account
,ID of the account
,Whether the user is active and can login (users only)
,Whether the user is a system admin (users only)
,Whether the user was imported from an upstream identity provider
,Whether the account is an organization (or user)
,The number of members of the organization
,Name of the account
{
"accounts": [
{
"fullName": "string",
"id": "string",
"isActive": true,
"isAdmin": true,
"isImported": true,
"isOrg": true,
"membersCount": 0,
"name": "string"
}
]
}Update information about user accounts or organizations, in bulk. Requires authentication and authorization as an admin user.
List of results for the bulk operation. The index of a bulk result corresponds to the index of the resource in the bulk request if result identifiers are omitted
If not successful, the error encountered when performing the operation on this resource
,The operation which was perfomed
,The corresponding identifier in the bulk operation request
,Whether the bulk operation was successful for this resource
{
"results": [
{
"error": {
"code": "string",
"detail": {},
"message": "string"
},
"op": "string",
"ref": "string",
"success": true
}
]
}Create a user or organization account. To search for and import a user from an LDAP directory, the system must be configured with LDAP integration. Requires authentication and authorization as an admin user.
Full Name of the account
,ID of the account
,Whether the user is active and can login (users only)
,Whether the user is a system admin (users only)
,Whether the user was imported from an upstream identity provider
,Whether the account is an organization (or user)
,The number of members of the organization
,Name of the account
{
"fullName": "string",
"id": "string",
"isActive": true,
"isAdmin": true,
"isImported": true,
"isOrg": true,
"membersCount": 0,
"name": "string"
}Delete a user or organization account. If the system is configured to import users from an LDAP directory, the user may be created again if they still match the current LDAP search config. Requires authentication and authorization as an admin user.
Details for a user or organization account. Requires authentication and authorization as any user.
Full Name of the account
,ID of the account
,Whether the user is active and can login (users only)
,Whether the user is a system admin (users only)
,Whether the user was imported from an upstream identity provider
,Whether the account is an organization (or user)
,The number of members of the organization
,Name of the account
{
"fullName": "string",
"id": "string",
"isActive": true,
"isAdmin": true,
"isImported": true,
"isOrg": true,
"membersCount": 0,
"name": "string"
}Update details for a user or organization account. Requires authentication and authorization as an admin user, the target user (if a user), or an admin member of the target organization (if an organization).
Full Name of the account
,ID of the account
,Whether the user is active and can login (users only)
,Whether the user is a system admin (users only)
,Whether the user was imported from an upstream identity provider
,Whether the account is an organization (or user)
,The number of members of the organization
,Name of the account
{
"fullName": "string",
"id": "string",
"isActive": true,
"isAdmin": true,
"isImported": true,
"isOrg": true,
"membersCount": 0,
"name": "string"
}List accountPublicKeys in an account. Lists accountPublicKeys in ascending order by key ID. Requires authentication and authorization as any user.
the ID of the account
,certificates for the public key
,the hash of the public key's DER bytes
,the label or description for the key
,the encoded PEM of the public key
Encoded PEM for the cert
,Label for the certificate
{
"accountPublicKeys": [
{
"accountID": "string",
"certificates": [
{
"cert": "string",
"label": "string"
}
],
"id": "string",
"label": "string",
"publicKey": "string"
}
]
}Create a public key for an account. Requires authentication and authorization as an admin user, the target user (if a user), or an admin member of the target organization (if an organization).
the ID of the account
,certificates for the public key
,the hash of the public key's DER bytes
,the label or description for the key
,the encoded PEM of the public key
Encoded PEM for the cert
,Label for the certificate
{
"accountID": "string",
"certificates": [
{
"cert": "string",
"label": "string"
}
],
"id": "string",
"label": "string",
"publicKey": "string"
}Remove an account public key. Requires authentication and authorization as an admin user, the target user (if a user), or an admin member of the target organization (if an organization).
Update details for an account public key. Requires authentication and authorization as an admin user, the target user (if a user), or an admin member of the target organization (if an organization).
the ID of the account
,certificates for the public key
,the hash of the public key's DER bytes
,the label or description for the key
,the encoded PEM of the public key
Encoded PEM for the cert
,Label for the certificate
{
"accountID": "string",
"certificates": [
{
"cert": "string",
"label": "string"
}
],
"id": "string",
"label": "string",
"publicKey": "string"
}Get options for syncing admin members of an organization. Requires authentication and authorization as an admin user or an admin member of the organization.
Whether to enable LDAP syncing. If false, all other fields are ignored
,The distinguished name of the LDAP group. Applicable only if selectGroupMembers is true, ignored otherwise
,The name of the LDAP group entry attribute which corresponds to distinguished names of members. Applicable only if selectGroupMembers is true, ignored otherwise
,The distinguished name of the element from which the LDAP server will search for users. Applicable only if selectGroupMembers is false, ignored otherwise
,The LDAP search filter used to select users if selectGroupMembers is false, may be left blank
,Whether to search for users in the entire subtree of the base DN or to only search one level under the base DN (if false). Applicable only if selectGroupMembers is false, ignored otherwise
,Whether to sync using a group DN and member attribute selection or to use a search filter (if false)
{
"enableSync": true,
"groupDN": "string",
"groupMemberAttr": "string",
"searchBaseDN": "string",
"searchFilter": "string",
"searchScopeSubtree": true,
"selectGroupMembers": true
}Set options for syncing admin members of an organization. Enabling sync of organization admin members will disable the ability to directly manage organization membership for any users imported from an LDAP directory. Their organization membership is instead set by being synced as an admin member of the organization or by being a member of any team within the organization. Requires authentication and authorization as an admin user or an admin member of the organization.
Whether to enable LDAP syncing. If false, all other fields are ignored
,The distinguished name of the LDAP group. Applicable only if selectGroupMembers is true, ignored otherwise
,The name of the LDAP group entry attribute which corresponds to distinguished names of members. Applicable only if selectGroupMembers is true, ignored otherwise
,The distinguished name of the element from which the LDAP server will search for users. Applicable only if selectGroupMembers is false, ignored otherwise
,The LDAP search filter used to select users if selectGroupMembers is false, may be left blank
,Whether to search for users in the entire subtree of the base DN or to only search one level under the base DN (if false). Applicable only if selectGroupMembers is false, ignored otherwise
,Whether to sync using a group DN and member attribute selection or to use a search filter (if false)
{
"enableSync": true,
"groupDN": "string",
"groupMemberAttr": "string",
"searchBaseDN": "string",
"searchFilter": "string",
"searchScopeSubtree": true,
"selectGroupMembers": true
}List members of an organization. Lists memberships in ascending order by user ID. Requires authentication and authorization as an admin user or a member of the organization.
Whether the member is an admin of the organization or team
,The user which is a member of the organization or team
Full Name of the account
,ID of the account
,Whether the user is active and can login (users only)
,Whether the user is a system admin (users only)
,Whether the user was imported from an upstream identity provider
,Whether the account is an organization (or user)
,The number of members of the organization
,Name of the account
{
"members": [
{
"isAdmin": true,
"member": {
"fullName": "string",
"id": "string",
"isActive": true,
"isAdmin": true,
"isImported": true,
"isOrg": true,
"membersCount": 0,
"name": "string"
}
}
]
}Remove a user from an organization. Removing a member of the organization will also remove them from any teams in the organization. If organization admin members are configured to be synced with LDAP, users which are imported from LDAP cannot be manually removed as members of the organization and must be either synced as an organization admin member or removed as a member of all teams within the organization. Requires authentication and authorization as an admin user or an admin member of the organization.
Details of a user's membership in an organization. Requires authentication and authorization as an admin user, a member of the organization, or the target user.
Whether the member is an admin of the organization or team
,The user which is a member of the organization or team
Full Name of the account
,ID of the account
,Whether the user is active and can login (users only)
,Whether the user is a system admin (users only)
,Whether the user was imported from an upstream identity provider
,Whether the account is an organization (or user)
,The number of members of the organization
,Name of the account
{
"isAdmin": true,
"member": {
"fullName": "string",
"id": "string",
"isActive": true,
"isAdmin": true,
"isImported": true,
"isOrg": true,
"membersCount": 0,
"name": "string"
}
}Add a user to an organization. If organization admin members are configured to be synced with LDAP, users which are imported from LDAP cannot be manually added as members of the organization and must be either synced as an organization admin member or be added as a member of team within the organization. Requires authentication and authorization as an admin user or an admin member of the organization
Whether the member is an admin of the organization or team
,The user which is a member of the organization or team
Full Name of the account
,ID of the account
,Whether the user is active and can login (users only)
,Whether the user is a system admin (users only)
,Whether the user was imported from an upstream identity provider
,Whether the account is an organization (or user)
,The number of members of the organization
,Name of the account
{
"isAdmin": true,
"member": {
"fullName": "string",
"id": "string",
"isActive": true,
"isAdmin": true,
"isImported": true,
"isOrg": true,
"membersCount": 0,
"name": "string"
}
}List a user's team membership in an organization. Lists team memberships in ascending order by team ID. Requires authentication and authorization as an admin user or a member of the organization.
Whether the user is an admin of the team
,The team which the user is a member of
Description of the team
,ID of the team
,The number of members of the team
,Name of the team
,ID of the organization to which this team belongs
{
"memberTeams": [
{
"isAdmin": true,
"team": {
"description": "string",
"id": "string",
"membersCount": 0,
"name": "string",
"orgID": "string"
}
}
]
}List teams in an organization. Lists teams in ascending order by name. Requires authentication and authorization as an admin user or a member of the organization.
Description of the team
,ID of the team
,The number of members of the team
,Name of the team
,ID of the organization to which this team belongs
{
"teams": [
{
"description": "string",
"id": "string",
"membersCount": 0,
"name": "string",
"orgID": "string"
}
]
}Create a team. Requires authentication and authorization as an admin user or an admin member of the organization.
Description of the team
,ID of the team
,The number of members of the team
,Name of the team
,ID of the organization to which this team belongs
{
"description": "string",
"id": "string",
"membersCount": 0,
"name": "string",
"orgID": "string"
}Delete a team. Requires authentication and authorization as an admin user or an admin member of the organization.
Details for a team. Requires authentication and authorization as an admin user or a member of the organization.
Description of the team
,ID of the team
,The number of members of the team
,Name of the team
,ID of the organization to which this team belongs
{
"description": "string",
"id": "string",
"membersCount": 0,
"name": "string",
"orgID": "string"
}Update details for a team. Requires authentication and authorization as an admin user, an admin member of the organization, or an admin member of the team.
Description of the team
,ID of the team
,The number of members of the team
,Name of the team
,ID of the organization to which this team belongs
{
"description": "string",
"id": "string",
"membersCount": 0,
"name": "string",
"orgID": "string"
}Get options for syncing members of a team. Requires authentication and authorization as an admin user, an admin member of the organization, or an admin member of the team.
Whether to enable LDAP syncing. If false, all other fields are ignored
,The distinguished name of the LDAP group. Applicable only if selectGroupMembers is true, ignored otherwise
,The name of the LDAP group entry attribute which corresponds to distinguished names of members. Applicable only if selectGroupMembers is true, ignored otherwise
,The distinguished name of the element from which the LDAP server will search for users. Applicable only if selectGroupMembers is false, ignored otherwise
,The LDAP search filter used to select users if selectGroupMembers is false, may be left blank
,Whether to search for users in the entire subtree of the base DN or to only search one level under the base DN (if false). Applicable only if selectGroupMembers is false, ignored otherwise
,Whether to sync using a group DN and member attribute selection or to use a search filter (if false)
{
"enableSync": true,
"groupDN": "string",
"groupMemberAttr": "string",
"searchBaseDN": "string",
"searchFilter": "string",
"searchScopeSubtree": true,
"selectGroupMembers": true
}Set options for syncing members of a team. Enabling sync of team members will disable the ability to manually manage team membership for any users imported from LDAP. Their team membership is instead managed by the LDAP sync. Requires authentication and authorization as an admin user, an admin member of the organization, or an admin member of the team.
Whether to enable LDAP syncing. If false, all other fields are ignored
,The distinguished name of the LDAP group. Applicable only if selectGroupMembers is true, ignored otherwise
,The name of the LDAP group entry attribute which corresponds to distinguished names of members. Applicable only if selectGroupMembers is true, ignored otherwise
,The distinguished name of the element from which the LDAP server will search for users. Applicable only if selectGroupMembers is false, ignored otherwise
,The LDAP search filter used to select users if selectGroupMembers is false, may be left blank
,Whether to search for users in the entire subtree of the base DN or to only search one level under the base DN (if false). Applicable only if selectGroupMembers is false, ignored otherwise
,Whether to sync using a group DN and member attribute selection or to use a search filter (if false)
{
"enableSync": true,
"groupDN": "string",
"groupMemberAttr": "string",
"searchBaseDN": "string",
"searchFilter": "string",
"searchScopeSubtree": true,
"selectGroupMembers": true
}List members of a team. Lists memberships in ascending order by user ID. Requires authentication and authorization as an admin user or a member of the organization.
Whether the member is an admin of the organization or team
,The user which is a member of the organization or team
Full Name of the account
,ID of the account
,Whether the user is active and can login (users only)
,Whether the user is a system admin (users only)
,Whether the user was imported from an upstream identity provider
,Whether the account is an organization (or user)
,The number of members of the organization
,Name of the account
{
"members": [
{
"isAdmin": true,
"member": {
"fullName": "string",
"id": "string",
"isActive": true,
"isAdmin": true,
"isImported": true,
"isOrg": true,
"membersCount": 0,
"name": "string"
}
}
]
}Remove a member from a team. The user will remain a member of the organization. If team members are configured to be synced with LDAP, users which are imported from LDAP cannot be manually removed as members of the team and must be synced with LDAP. Requires authentication and authorization as an admin user, an admin member of the organization, or an admin member of the team.
Details of a user's membership in a team. Requires authentication and authorization as an admin user or a member of the organization.
Whether the member is an admin of the organization or team
,The user which is a member of the organization or team
Full Name of the account
,ID of the account
,Whether the user is active and can login (users only)
,Whether the user is a system admin (users only)
,Whether the user was imported from an upstream identity provider
,Whether the account is an organization (or user)
,The number of members of the organization
,Name of the account
{
"isAdmin": true,
"member": {
"fullName": "string",
"id": "string",
"isActive": true,
"isAdmin": true,
"isImported": true,
"isOrg": true,
"membersCount": 0,
"name": "string"
}
}Add a user to a team. The user will be added as a member of the organization if they are not already. If team members are configured to be synced with LDAP, users which are imported from LDAP cannot be manually added as members of the team and must be synced with LDAP. Requires authentication and authorization as an admin user, an admin member of the organization, or an admin member of the team.
Whether the member is an admin of the organization or team
,The user which is a member of the organization or team
Full Name of the account
,ID of the account
,Whether the user is active and can login (users only)
,Whether the user is a system admin (users only)
,Whether the user was imported from an upstream identity provider
,Whether the account is an organization (or user)
,The number of members of the organization
,Name of the account
{
"isAdmin": true,
"member": {
"fullName": "string",
"id": "string",
"isActive": true,
"isAdmin": true,
"isImported": true,
"isOrg": true,
"membersCount": 0,
"name": "string"
}
}Change a user's password. Requires authentication and authorization as an admin user or the target user.
Full Name of the account
,ID of the account
,Whether the user is active and can login (users only)
,Whether the user is a system admin (users only)
,Whether the user was imported from an upstream identity provider
,Whether the account is an organization (or user)
,The number of members of the organization
,Name of the account
{
"fullName": "string",
"id": "string",
"isActive": true,
"isAdmin": true,
"isImported": true,
"isOrg": true,
"membersCount": 0,
"name": "string"
}List a user's organization memberships. Lists organization memberships in ascending order by organization ID. Requires authentication and authorization as an admin user or the target user.
Whether the user is an admin of the organization
,The organization which the user is a member of
Full Name of the account
,ID of the account
,Whether the user is active and can login (users only)
,Whether the user is a system admin (users only)
,Whether the user was imported from an upstream identity provider
,Whether the account is an organization (or user)
,The number of members of the organization
,Name of the account
{
"memberOrgs": [
{
"isAdmin": true,
"org": {
"fullName": "string",
"id": "string",
"isActive": true,
"isAdmin": true,
"isImported": true,
"isOrg": true,
"membersCount": 0,
"name": "string"
}
}
]
}Base64-url-safe-encoded config data
,User-defined key/value metadata.
,User-defined name of the config.
[
{
"CreatedAt": "2016-11-05T01:20:17.327670065Z",
"ID": "ktnbjxoalbkvbvedmg1urrz8h",
"Spec": {
"Name": "server.conf"
},
"UpdatedAt": "2016-11-05T01:20:17.327670065Z",
"Version": {
"Index": 11
}
}
]If you create a UCP config with a name that starts with com.docker.ucp.config, UCP verifies that the config is valid before saving it. Also, UCP validates any licenses with names that start with com.docker.license.
The ID of the created config.
{
"ID": "ktnbjxoalbkvbvedmg1urrz8h"
}Base64-url-safe-encoded config data
,User-defined key/value metadata.
,User-defined name of the config.
{
"CreatedAt": "2016-11-05T01:20:17.327670065Z",
"ID": "ktnbjxoalbkvbvedmg1urrz8h",
"Spec": {
"Name": "app-dev.crt"
},
"UpdatedAt": "2016-11-05T01:20:17.327670065Z",
"Version": {
"Index": 11
}
}The ID of the created container
,Warnings encountered when creating the container
{
"Id": "e90e34656806",
"Warnings": []
}Command to run when starting the container
,When the container was created
,The ID of this container
,The name of the image used when creating this container
,The ID of the image that this container was created from
,User-defined key/value metadata.
,The names that this container has been given
,A summary of the container's network settings
,The ports exposed by this container
,The total size of all the files in this container
,The size of files that have been created or changed by this container
,The state of this container (e.g. Exited)
Additional human-readable status of this container (e.g. Exit 0)
Optional configuration for the bind type.
The consistency requirement for the mount: default, consistent, cached, or delegated.
Whether the mount should be read-only.
,Mount source (e.g. a volume name, a host path).
,Container path.
,Optional configuration for the tmpfs type.
The mount type. Available types:
bind Mounts a file or directory from the host into the container. Must exist prior to creating the container.volume Creates a volume with the given name and options (or uses a pre-existing volume with the same name and options). These are not removed when the container is removed.tmpfs Create a tmpfs with the given options. The mount source cannot be specified for tmpfs.| string | |
|---|---|
| Enum: | "bind", "volume", "tmpfs" |
Optional configuration for the volume type.
Port on the container
,Port exposed on the host
,| string | |
|---|---|
| Enum: | "tcp", "udp" |
A propagation mode with the value [r]private, [r]shared, or [r]slave.
| object | |
|---|---|
| Enum: | "private", "rprivate", "shared", "rshared", "slave", "rslave" |
The permission mode for the tmpfs mount in an integer.
,The size for the tmpfs mount in bytes.
Map of driver specific options
,User-defined key/value metadata.
,Populate volume with data from the target.
| boolean | |
|---|---|
| Default: | false |
Name of the driver to use to create the volume.
,key/value map of driver specific options.
[
{
"Command": "echo 1",
"Created": 1367854155,
"HostConfig": {
"NetworkMode": "default"
},
"Id": "8dfafdbc3a40",
"Image": "ubuntu:latest",
"ImageID": "d74508fb6632491cea586a1fd7d748dfc5274cd6fdfedee309ecdcbc2bf5cb82",
"Labels": {
"com.example.license": "GPL",
"com.example.vendor": "Acme",
"com.example.version": "1.0"
},
"Mounts": [
{
"Destination": "/data",
"Driver": "local",
"Mode": "ro,Z",
"Name": "fac362...80535",
"Propagation": "",
"RW": false,
"Source": "/data"
}
],
"Names": [
"/boring_feynman"
],
"NetworkSettings": {
"Networks": {
"bridge": {
"EndpointID": "2cdc4edb1ded3631c81f57966563e5c8525b81121bb3706a9a9a3ae102711f3f",
"Gateway": "172.17.0.1",
"GlobalIPv6Address": "",
"GlobalIPv6PrefixLen": 0,
"IPAddress": "172.17.0.2",
"IPPrefixLen": 16,
"IPv6Gateway": "",
"MacAddress": "02:42:ac:11:00:02",
"NetworkID": "7ea29fc1412292a2d7bba362f9253545fecdfa8ce9a6e37dd10ba8bee7129812"
}
}
},
"Ports": [
{
"PrivatePort": 2222,
"PublicPort": 3333,
"Type": "tcp"
}
],
"SizeRootFs": 0,
"SizeRw": 12288,
"State": "Exited",
"Status": "Exit 0"
},
{
"Command": "echo 222222",
"Created": 1367854155,
"HostConfig": {
"NetworkMode": "default"
},
"Id": "9cd87474be90",
"Image": "ubuntu:latest",
"ImageID": "d74508fb6632491cea586a1fd7d748dfc5274cd6fdfedee309ecdcbc2bf5cb82",
"Labels": {},
"Mounts": [],
"Names": [
"/coolName"
],
"NetworkSettings": {
"Networks": {
"bridge": {
"EndpointID": "88eaed7b37b38c2a3f0c4bc796494fdf51b270c2d22656412a2ca5d559a64d7a",
"Gateway": "172.17.0.1",
"GlobalIPv6Address": "",
"GlobalIPv6PrefixLen": 0,
"IPAddress": "172.17.0.8",
"IPPrefixLen": 16,
"IPv6Gateway": "",
"MacAddress": "02:42:ac:11:00:08",
"NetworkID": "7ea29fc1412292a2d7bba362f9253545fecdfa8ce9a6e37dd10ba8bee7129812"
}
}
},
"Ports": [],
"SizeRootFs": 0,
"SizeRw": 12288,
"State": "Exited",
"Status": "Exit 0"
},
{
"Command": "echo 3333333333333333",
"Created": 1367854154,
"HostConfig": {
"NetworkMode": "default"
},
"Id": "3176a2479c92",
"Image": "ubuntu:latest",
"ImageID": "d74508fb6632491cea586a1fd7d748dfc5274cd6fdfedee309ecdcbc2bf5cb82",
"Labels": {},
"Mounts": [],
"Names": [
"/sleepy_dog"
],
"NetworkSettings": {
"Networks": {
"bridge": {
"EndpointID": "8b27c041c30326d59cd6e6f510d4f8d1d570a228466f956edf7815508f78e30d",
"Gateway": "172.17.0.1",
"GlobalIPv6Address": "",
"GlobalIPv6PrefixLen": 0,
"IPAddress": "172.17.0.6",
"IPPrefixLen": 16,
"IPv6Gateway": "",
"MacAddress": "02:42:ac:11:00:06",
"NetworkID": "7ea29fc1412292a2d7bba362f9253545fecdfa8ce9a6e37dd10ba8bee7129812"
}
}
},
"Ports": [],
"SizeRootFs": 0,
"SizeRw": 12288,
"State": "Exited",
"Status": "Exit 0"
},
{
"Command": "echo 444444444444444444444444444444444",
"Created": 1367854152,
"HostConfig": {
"NetworkMode": "default"
},
"Id": "4cb07b47f9fb",
"Image": "ubuntu:latest",
"ImageID": "d74508fb6632491cea586a1fd7d748dfc5274cd6fdfedee309ecdcbc2bf5cb82",
"Labels": {},
"Mounts": [],
"Names": [
"/running_cat"
],
"NetworkSettings": {
"Networks": {
"bridge": {
"EndpointID": "d91c7b2f0644403d7ef3095985ea0e2370325cd2332ff3a3225c4247328e66e9",
"Gateway": "172.17.0.1",
"GlobalIPv6Address": "",
"GlobalIPv6PrefixLen": 0,
"IPAddress": "172.17.0.5",
"IPPrefixLen": 16,
"IPv6Gateway": "",
"MacAddress": "02:42:ac:11:00:05",
"NetworkID": "7ea29fc1412292a2d7bba362f9253545fecdfa8ce9a6e37dd10ba8bee7129812"
}
}
},
"Ports": [],
"SizeRootFs": 0,
"SizeRw": 12288,
"State": "Exited",
"Status": "Exit 0"
}
]Container IDs that were deleted
,Disk space reclaimed in bytes
{
"ContainersDeleted": [
"string"
],
"SpaceReclaimed": 0
}Get a tar archive of a resource in the filesystem of container id.
A response header X-Docker-Container-Path-Stat is return containing a base64 - encoded JSON object with some filesystem header information about the path.
Upload a tar archive to be extracted to a path in the filesystem of container id.
Attach to a container to read its output or send it input. You can attach to the same container multiple times and you can reattach to containers that have been detached.
Either the stream or logs parameter must be true for this endpoint to do anything.
See the documentation for the docker attach command for more details.
This endpoint hijacks the HTTP connection to transport stdin, stdout, and stderr on the same socket.
This is the response from the daemon for an attach request:
HTTP/1.1 200 OK
Content-Type: application/vnd.docker.raw-stream
[STREAM]
After the headers and two new lines, the TCP connection can now be used for raw, bidirectional communication between the client and server.
To hint potential proxies about connection hijacking, the Docker client can also optionally send connection upgrade headers.
For example, the client sends this request to upgrade the connection:
POST /containers/16253994b7c4/attach?stream=1&stdout=1 HTTP/1.1
Upgrade: tcp
Connection: Upgrade
The Docker daemon will respond with a 101 UPGRADED response, and will similarly follow with the raw stream:
HTTP/1.1 101 UPGRADED
Content-Type: application/vnd.docker.raw-stream
Connection: Upgrade
Upgrade: tcp
[STREAM]
When the TTY setting is disabled in POST /containers/create, the stream over the hijacked connected is multiplexed to separate out stdout and stderr. The stream consists of a series of frames, each containing a header and a payload.
The header contains the information which the stream writes (stdout or stderr). It also contains the size of the associated frame encoded in the last four bytes (uint32).
It is encoded on the first eight bytes like this:
header := [8]byte{STREAM_TYPE, 0, 0, 0, SIZE1, SIZE2, SIZE3, SIZE4}
STREAM_TYPE can be:
stdin (is written on stdout)stdoutstderrSIZE1, SIZE2, SIZE3, SIZE4 are the four bytes of the uint32 size encoded as big endian.
Following the header is the payload, which is the specified number of bytes of STREAM_TYPE.
The simplest way to implement this protocol is the following:
stdout or stderr depending on the first byte.When the TTY setting is enabled in POST /containers/create, the stream is not multiplexed. The data exchanged over the hijacked connection is simply the raw data from the process PTY and client's stdin.
Returns which files in a container's filesystem have been added, deleted,
or modified. The Kind of modification can be one of:
0: Modified1: Added2: DeletedKind of change
= ['0', '1', '2']| integer | |
|---|---|
| Enum: | 0, 1, 2 |
Path to file that has changed
[
{
"Kind": 0,
"Path": "/dev"
},
{
"Kind": 1,
"Path": "/dev/kmsg"
},
{
"Kind": 1,
"Path": "/test"
}
]Export the contents of a container as a tarball.
Return low-level information about a container.
The arguments to the command being run
,The time the container was created
,The ID of the container
,The container's image
,TODO
,The path to the command being run
,The total size of all the files in this container.
,The size of files that have been created or changed by this container.
,The state of the container.
Command is already escaped (Windows only)
,Whether to attach to stderr.
| boolean | |
|---|---|
| Default: | true |
Whether to attach to stdin.
| boolean | |
|---|---|
| Default: | false |
Whether to attach to stdout.
| boolean | |
|---|---|
| Default: | true |
Command to run specified as a string or an array of strings.
,The domain name to use for the container.
,The entry point for the container as a string or an array of strings.
If the array consists of exactly one empty string ([""]) then the entry point is reset to system default (i.e., the entry point used by docker when there is no ENTRYPOINT instruction in the Dockerfile).
A list of environment variables to set inside the container in the form ["VAR=value", ...]. A variable without = is removed from the environment, rather than to have an empty value.
An object mapping ports to an empty object in the form:
{"<port>/<tcp|udp>": {}}
The hostname to use for the container, as a valid RFC 1123 hostname.
,The name of the image to use when creating the container
,User-defined key/value metadata.
,MAC address of the container.
,Disable networking for the container.
,ONBUILD metadata that were defined in the image's Dockerfile.
Open stdin
| boolean | |
|---|---|
| Default: | false |
Shell for when RUN, CMD, and ENTRYPOINT uses a shell.
Close stdin after one attached client disconnects
| boolean | |
|---|---|
| Default: | false |
Signal to stop a container as a string or unsigned integer.
| string | |
|---|---|
| Default: | SIGTERM |
Timeout to stop a container in seconds.
| integer | |
|---|---|
| Default: | 10 |
Attach standard streams to a TTY, including stdin if it is not closed.
| boolean | |
|---|---|
| Default: | false |
The user that commands are run as inside the container.
,An object mapping mount point paths inside the container to empty objects.
,The working directory for commands to run in.
Limit read rate (bytes per second) from a device, in the form [{"Path": "device_path", "Rate": rate}].
Limit read rate (IO per second) from a device, in the form [{"Path": "device_path", "Rate": rate}].
Limit write rate (bytes per second) to a device, in the form [{"Path": "device_path", "Rate": rate}].
Limit write rate (IO per second) to a device, in the form [{"Path": "device_path", "Rate": rate}].
Block IO weight (relative weight).
| integer | |
|---|---|
| Max. Value: | 1000 |
Block IO weight (relative device weight) in the form [{"Path": "device_path", "Weight": weight}].
Path to cgroups under which the container's cgroup is created. If the path is not absolute, the path is considered to be relative to the cgroups path of the init process. Cgroups are created if they do not already exist.
The number of usable CPUs (Windows only).
On Windows Server containers, the processor resource controls are mutually exclusive. The order of precedence is CPUCount first, then CPUShares, and CPUPercent last.
The usable percentage of the available CPUs (Windows only).
On Windows Server containers, the processor resource controls are mutually exclusive. The order of precedence is CPUCount first, then CPUShares, and CPUPercent last.
The length of a CPU period in microseconds.
,Microseconds of CPU time that the container can get in a CPU period.
,The length of a CPU real-time period in microseconds. Set to 0 to allocate no time allocated to real-time tasks.
,The length of a CPU real-time runtime in microseconds. Set to 0 to allocate no time allocated to real-time tasks.
,An integer value representing this container's relative CPU weight versus other containers.
,CPUs in which to allow execution (e.g., 0-3, 0,1)
Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on NUMA systems.
,a list of cgroup rules to apply to the container
,A list of devices to add to the container.
,Disk limit (in bytes).
,Maximum IO in bytes per second for the container system drive (Windows only)
,Maximum IOps for the container system drive (Windows only)
,Kernel memory limit in bytes.
,Memory limit in bytes.
| integer | |
|---|---|
| Default: | 0 |
Memory soft limit in bytes.
,Total memory limit (memory + swap). Set as -1 to enable unlimited swap.
Tune a container's memory swappiness behavior. Accepts an integer between 0 and 100.
| integer | |
|---|---|
| Max. Value: | 100 |
CPU quota in units of 10-9 CPUs.
,Disable OOM Killer for the container.
,Tune a container's pids limit. Set -1 for unlimited.
,A list of resource limits to set in the container. For example: {"Name": "nofile", "Soft": 1024, "Hard": 2048}"
Automatically remove the container when the container's process exits. This has no effect if RestartPolicy is set.
A list of volume bindings for this container. Each volume binding is a string in one of these forms:
host-src:container-dest to bind-mount a host path into the container. Both host-src, and container-dest must be an absolute path.host-src:container-dest:ro to make the bind-mount read-only inside the container. Both host-src, and container-dest must be an absolute path.volume-name:container-dest to bind-mount a volume managed by a volume driver into the container. container-dest must be an absolute path.volume-name:container-dest:ro to mount the volume read-only inside the container. container-dest must be an absolute path.A list of kernel capabilities to add to the container.
,A list of kernel capabilities to drop from the container.
,Cgroup to use for the container.
,Initial console size, as an [height, width] array. (Windows only)
| integer | |
|---|---|
| Min. Items: | 2 |
| Max. Items: | 2 |
Path to a file where the container ID is written
,A list of DNS servers for the container to use.
,A list of DNS options.
,A list of DNS search domains.
,A list of hostnames/IP mappings to add to the container's /etc/hosts file. Specified in the form ["hostname:IP"].
A list of additional groups that the container process will run as.
,IPC namespace to use for the container.
,Isolation technology of the container. (Windows only)
= ['default', 'process', 'hyperv']| string | |
|---|---|
| Enum: | "default", "process", "hyperv" |
A list of links for the container in the form container_name:alias.
The logging configuration for this container
,Specification for mounts to be added to the container.
,Network mode to use for this container. Supported standard values are: bridge, host, none, and container:<name|id>. Any other value is taken as a custom network's name to which this container should connect to.
An integer value containing the score given to the container in order to tune OOM killer preferences.
,Set the PID (Process) Namespace mode for the container. It can be either:
"container:<name|id>": joins another container's PID namespace"host": use the host's PID namespace inside the container
A map of exposed container ports and the host port they should map to.
,Gives the container full access to the host.
,Allocates a random host port for all of a container's exposed ports.
,Mount the container's root filesystem as read only.
,Runtime to use with this container.
,A list of string values to customize labels for MLS systems, such as SELinux.
,Size of /dev/shm in bytes. If omitted, the system uses 64MB.
Storage driver options for this container, in the form {"size": "120G"}.
A list of kernel parameters (sysctls) to set in the container. For example: {"net.ipv4.ip_forward": "1"}
A map of container directories which should be replaced by tmpfs mounts, and their corresponding mount options. For example: { "/run": "rw,noexec,nosuid,size=65536k" }.
UTS namespace to use for the container.
,Sets the usernamespace mode for the container when usernamespace remapping option is enabled.
,Driver that this container uses to mount volumes.
,A list of volumes to inherit from another container, specified in the form <container name="">[:<ro|rw>].
The last exit code of this container
,The time when this container last exited.
,Whether this container has been killed because it ran out of memory.
,Whether this container is paused.
,The process ID of this container
,Whether this container is restarting.
,Whether this container is running.
Note that a running container can be paused. The Running and Paused
booleans are not mutually exclusive:
When pausing a container (on Linux), the cgroups freezer is used to suspend
all processes in the container. Freezing the process requires the process to
be running. As a result, paused containers are both Running and Paused.
Use the Status field instead to determine if a container's state is "running".
The time when this container was last started.
,The status of the container. For example, "running" or "exited".
| string | |
|---|---|
| Enum: | "created", "running", "paused", "restarting", "removing", "exited", "dead" |
The time to wait between checks in nanoseconds. It should be 0 or at least 1000000 (1 ms). 0 means inherit.
,The number of consecutive failures needed to consider a container as unhealthy. 0 means inherit.
,Start period for the container to initialize before starting health-retries countdown in nanoseconds. It should be 0 or at least 1000000 (1 ms). 0 means inherit.
,The test to perform. Possible values are:
[] inherit healthcheck from image or parent image["NONE"] disable healthcheck["CMD", args...] exec arguments directly["CMD-SHELL", command] run command with system's default shellThe time to wait before considering the check to have hung. It should be 0 or at least 1000000 (1 ms). 0 means inherit.
| object | |
|---|---|
| Default: | [object Object] |
| Enum: | "[object Object]" |
Device path
,Rate
Hard limit
,Name of ulimit
,Soft limit
| string | |
|---|---|
| Enum: | "json-file", "syslog", "journald", "gelf", "fluentd", "awslogs", "splunk", "etwlogs", "none" |
Optional configuration for the bind type.
The consistency requirement for the mount: default, consistent, cached, or delegated.
Whether the mount should be read-only.
,Mount source (e.g. a volume name, a host path).
,Container path.
,Optional configuration for the tmpfs type.
The mount type. Available types:
bind Mounts a file or directory from the host into the container. Must exist prior to creating the container.volume Creates a volume with the given name and options (or uses a pre-existing volume with the same name and options). These are not removed when the container is removed.tmpfs Create a tmpfs with the given options. The mount source cannot be specified for tmpfs.| string | |
|---|---|
| Enum: | "bind", "volume", "tmpfs" |
Optional configuration for the volume type.
If on-failure is used, the number of times to retry before giving up
always Always restartunless-stopped Restart always except when the user has manually stopped the containeron-failure Restart only when the container exit code is non-zero| string | |
|---|---|
| Enum: | "", "always", "unless-stopped", "on-failure" |
Port on the container
,Port exposed on the host
,| string | |
|---|---|
| Enum: | "tcp", "udp" |
A propagation mode with the value [r]private, [r]shared, or [r]slave.
| object | |
|---|---|
| Enum: | "private", "rprivate", "shared", "rshared", "slave", "rslave" |
The permission mode for the tmpfs mount in an integer.
,The size for the tmpfs mount in bytes.
Map of driver specific options
,User-defined key/value metadata.
,Populate volume with data from the target.
| boolean | |
|---|---|
| Default: | false |
Name of the driver to use to create the volume.
,key/value map of driver specific options.
{
"AppArmorProfile": "",
"Args": [
"-c",
"exit 9"
],
"Config": {
"AttachStderr": true,
"AttachStdin": false,
"AttachStdout": true,
"Cmd": [
"/bin/sh",
"-c",
"exit 9"
],
"Domainname": "",
"Env": [
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
],
"Hostname": "ba033ac44011",
"Image": "ubuntu",
"Labels": {
"com.example.license": "GPL",
"com.example.vendor": "Acme",
"com.example.version": "1.0"
},
"MacAddress": "",
"NetworkDisabled": false,
"OpenStdin": false,
"StdinOnce": false,
"StopSignal": "SIGTERM",
"StopTimeout": 10,
"Tty": false,
"User": "",
"Volumes": {
"/volumes/data": {}
},
"WorkingDir": ""
},
"Created": "2015-01-06T15:47:31.485331387Z",
"Driver": "devicemapper",
"HostConfig": {
"BlkioDeviceReadBps": [
{}
],
"BlkioDeviceReadIOps": [
{}
],
"BlkioDeviceWriteBps": [
{}
],
"BlkioDeviceWriteIOps": [
{}
],
"BlkioWeight": 0,
"BlkioWeightDevice": [
{}
],
"ContainerIDFile": "",
"CpuPercent": 80,
"CpuPeriod": 100000,
"CpuRealtimePeriod": 1000000,
"CpuRealtimeRuntime": 10000,
"CpuShares": 0,
"CpusetCpus": "",
"CpusetMems": "",
"Devices": [],
"IpcMode": "",
"KernelMemory": 0,
"LogConfig": {
"Type": "json-file"
},
"LxcConf": [],
"MaximumIOBps": 0,
"MaximumIOps": 0,
"Memory": 0,
"MemoryReservation": 0,
"MemorySwap": 0,
"NetworkMode": "bridge",
"OomKillDisable": false,
"OomScoreAdj": 500,
"PidMode": "",
"PortBindings": {},
"Privileged": false,
"PublishAllPorts": false,
"ReadonlyRootfs": false,
"RestartPolicy": {
"MaximumRetryCount": 2,
"Name": "on-failure"
},
"ShmSize": 67108864,
"Sysctls": {
"net.ipv4.ip_forward": "1"
},
"Ulimits": [
{}
],
"VolumeDriver": ""
},
"HostnamePath": "/var/lib/docker/containers/ba033ac4401106a3b513bc9d639eee123ad78ca3616b921167cd74b20e25ed39/hostname",
"HostsPath": "/var/lib/docker/containers/ba033ac4401106a3b513bc9d639eee123ad78ca3616b921167cd74b20e25ed39/hosts",
"Id": "ba033ac4401106a3b513bc9d639eee123ad78ca3616b921167cd74b20e25ed39",
"Image": "04c5d3b7b0656168630d3ba35d8889bd0e9caafcaeb3004d2bfbc47e7c5d35d2",
"LogPath": "/var/lib/docker/containers/1eb5fabf5a03807136561b3c00adcd2992b535d624d5e18b6cdc6a6844d9767b/1eb5fabf5a03807136561b3c00adcd2992b535d624d5e18b6cdc6a6844d9767b-json.log",
"MountLabel": "",
"Mounts": [
{
"Destination": "/data",
"Driver": "local",
"Mode": "ro,Z",
"Name": "fac362...80535",
"Propagation": "",
"RW": false,
"Source": "/data"
}
],
"Name": "/boring_euclid",
"NetworkSettings": {
"Bridge": "",
"EndpointID": "",
"Gateway": "",
"GlobalIPv6Address": "",
"GlobalIPv6PrefixLen": 0,
"HairpinMode": false,
"IPAddress": "",
"IPPrefixLen": 0,
"IPv6Gateway": "",
"LinkLocalIPv6Address": "",
"LinkLocalIPv6PrefixLen": 0,
"MacAddress": "",
"Networks": {
"bridge": {
"EndpointID": "7587b82f0dada3656fda26588aee72630c6fab1536d36e394b2bfbcf898c971d",
"Gateway": "172.17.0.1",
"GlobalIPv6Address": "",
"GlobalIPv6PrefixLen": 0,
"IPAddress": "172.17.0.2",
"IPPrefixLen": 16,
"IPv6Gateway": "",
"MacAddress": "02:42:ac:12:00:02",
"NetworkID": "7ea29fc1412292a2d7bba362f9253545fecdfa8ce9a6e37dd10ba8bee7129812"
}
},
"SandboxID": "",
"SandboxKey": "",
"SecondaryIPAddresses": "",
"SecondaryIPv6Addresses": ""
},
"Path": "/bin/sh",
"ProcessLabel": "",
"ResolvConfPath": "/var/lib/docker/containers/ba033ac4401106a3b513bc9d639eee123ad78ca3616b921167cd74b20e25ed39/resolv.conf",
"RestartCount": 1,
"State": {
"Dead": false,
"Error": "",
"ExitCode": 9,
"FinishedAt": "2015-01-06T15:47:32.080254511Z",
"OOMKilled": false,
"Paused": false,
"Pid": 0,
"Restarting": false,
"Running": true,
"StartedAt": "2015-01-06T15:47:32.072697474Z",
"Status": "running"
}
}Send a POSIX signal to a container, defaulting to killing to the container.
Get stdout and stderr logs from a container.
Note: This endpoint works only for containers with the json-file or journald logging driver.
Use the cgroups freezer to suspend all processes in a container.
Traditionally, when suspending a process the SIGSTOP signal is used, which is observable by the process being suspended. With the cgroups freezer the process is unaware, and unable to capture, that it is being suspended, and subsequently resumed.
Resize the TTY for a container. You must restart the container for the resize to take effect.
This endpoint returns a live stream of a container’s resource usage statistics.
The precpu_stats is the CPU statistic of last read, which is used
for calculating the CPU usage percentage. It is not the same as the
cpu_stats field.
If either precpu_stats.online_cpus or cpu_stats.online_cpus is
nil then for compatibility with older daemons the length of the
corresponding cpu_usage.percpu_usage array should be used.
{
"blkio_stats": {},
"cpu_stats": {
"cpu_usage": {
"percpu_usage": [
8646879,
24472255,
36438778,
30657443
],
"total_usage": 100215355,
"usage_in_kernelmode": 30000000,
"usage_in_usermode": 50000000
},
"online_cpus": 4,
"system_cpu_usage": 739306590000000,
"throttling_data": {
"periods": 0,
"throttled_periods": 0,
"throttled_time": 0
}
},
"memory_stats": {
"failcnt": 0,
"limit": 67108864,
"max_usage": 6651904,
"stats": {
"active_anon": 6537216,
"active_file": 0,
"cache": 0,
"hierarchical_memory_limit": 67108864,
"inactive_anon": 0,
"inactive_file": 0,
"mapped_file": 0,
"pgfault": 964,
"pgmajfault": 0,
"pgpgin": 477,
"pgpgout": 414,
"rss": 6537216,
"rss_huge": 6291456,
"total_active_anon": 6537216,
"total_active_file": 0,
"total_cache": 0,
"total_inactive_anon": 0,
"total_inactive_file": 0,
"total_mapped_file": 0,
"total_pgfault": 964,
"total_pgmajfault": 0,
"total_pgpgin": 477,
"total_pgpgout": 414,
"total_rss": 6537216,
"total_rss_huge": 6291456,
"total_unevictable": 0,
"total_writeback": 0,
"unevictable": 0,
"writeback": 0
},
"usage": 6537216
},
"networks": {
"eth0": {
"rx_bytes": 5338,
"rx_dropped": 0,
"rx_errors": 0,
"rx_packets": 36,
"tx_bytes": 648,
"tx_dropped": 0,
"tx_errors": 0,
"tx_packets": 8
},
"eth5": {
"rx_bytes": 4641,
"rx_dropped": 0,
"rx_errors": 0,
"rx_packets": 26,
"tx_bytes": 690,
"tx_dropped": 0,
"tx_errors": 0,
"tx_packets": 9
}
},
"pids_stats": {
"current": 3
},
"precpu_stats": {
"cpu_usage": {
"percpu_usage": [
8646879,
24350896,
36438778,
30657443
],
"total_usage": 100093996,
"usage_in_kernelmode": 30000000,
"usage_in_usermode": 50000000
},
"online_cpus": 4,
"system_cpu_usage": 9492140000000,
"throttling_data": {
"periods": 0,
"throttled_periods": 0,
"throttled_time": 0
}
},
"read": "2015-01-08T22:57:31.547920715Z"
}On Unix systems, this is done by running the ps command. This endpoint is not supported on Windows.
Each process running in the container, where each is process is an array of values corresponding to the titles
,The ps column titles
{
"Processes": [
[
"root",
"13642",
"882",
"0",
"17:03",
"pts/0",
"00:00:00",
"/bin/bash"
],
[
"root",
"13735",
"13642",
"0",
"17:06",
"pts/0",
"00:00:00",
"sleep 10"
]
],
"Titles": [
"UID",
"PID",
"PPID",
"C",
"STIME",
"TTY",
"TIME",
"CMD"
]
}Resume a container which has been paused.
Block until a container stops, then returns the exit code.
Exit code of the container
{
"StatusCode": 0
}Return image digest and platform information by contacting the registry.
A descriptor struct containing digest, media type, and size
,An array containing all platforms supported by the image
{
"Descriptor": {
"Digest": "sha256:c0537ff6a5218ef531ece93d4984efc99bbf3f7497c0a7726c88e2bb7584dc96",
"MediaType": "application/vnd.docker.distribution.manifest.v2+json",
"Size": 3987495,
"URLs": [
""
]
},
"Platforms": [
{
"Architecture": "amd64",
"Features": [
""
],
"OS": "linux",
"OSFeatures": [
""
],
"OSVersion": "",
"Variant": ""
}
]
}Run a command inside a running container.
The id of the newly created object.
{
"Id": "string"
}Return low-level information about an exec instance.
The system process ID for the exec process.
,{
"CanRemove": false,
"ContainerID": "b53ee82b53a40c7dca428523e34f741f3abc51d9f297a14ff874bf761b995126",
"DetachKeys": "",
"ExitCode": 2,
"ID": "f33bbfb39f5b142420f4759b2348913bd4a8d1a6d7fd56499cb41a1bb91d7b3b",
"OpenStderr": true,
"OpenStdin": true,
"OpenStdout": true,
"Pid": 42000,
"ProcessConfig": {
"arguments": [
"-c",
"exit 2"
],
"entrypoint": "sh",
"privileged": false,
"tty": true,
"user": "1000"
},
"Running": false
}Resize the TTY session used by an exec instance. This endpoint only works if tty was specified as part of creating and starting the exec instance.
Starts a previously set up exec instance. If detach is true, this endpoint returns immediately after starting the command. Otherwise, it sets up an interactive session with the command.
Identify the Currently Authenticated Account.
Submit a Login Form in exchange for a Session Token
the authenticated user account
,the session token created by the login
Full Name of the account
,ID of the account
,Whether the user is active and can login (users only)
,Whether the user is a system admin (users only)
,Whether the user was imported from an upstream identity provider
,Whether the account is an organization (or user)
,The number of members of the organization
,Name of the account
{
"account": {
"fullName": "string",
"id": "string",
"isActive": true,
"isAdmin": true,
"isImported": true,
"isOrg": true,
"membersCount": 0,
"name": "string"
},
"sessionToken": "string"
}Delete the current session is use.
Build an image from a tar archive with a Dockerfile in it.
The Dockerfile specifies how the image is built from the tar archive. It is typically in the archive's root, but can be at a different path or have a different name by specifying the dockerfile parameter. See the Dockerfile reference for more information.
The Docker daemon performs a preliminary validation of the Dockerfile before starting the build, and returns an error if the syntax is incorrect. After that, each instruction is run one-by-one until the ID of the new image is output.
The build is canceled if the client drops the connection by quitting or being killed.
The id of the newly created object.
{
"Id": "string"
}Create an image by either pulling it from a registry or importing it.
The create request pulls the image onto every node in the swarm that exists at that time and that have the right operating system. Nodes that join the swarm later or that don't have the same base OS as the image won't get the image.
Get a tarball containing all images and metadata for several image repositories.
For each value of the names parameter: if it is a specific name and tag (e.g. ubuntu:latest), then only that image (and its parents) are returned; if it is an image ID, similarly only that image (and its parents) are returned and there would be no names referenced in the 'repositories' file for this image ID.
For details on the format, see the export image endpoint.
Returns a list of images on the server. Note that it uses a different, smaller representation of an image than inspecting a single image.
This endpoint returns the union of all images on all nodes in the cluster.
[
{
"Containers": 2,
"Created": 1474925151,
"Id": "sha256:e216a057b1cb1efc11f8a268f37ef62083e70b1b38323ba252e25ac88904a7e8",
"Labels": {},
"ParentId": "",
"RepoDigests": [
"ubuntu@sha256:992069aee4016783df6345315302fa59681aae51a8eeb2f889dea59290f21787"
],
"RepoTags": [
"ubuntu:12.04",
"ubuntu:precise"
],
"SharedSize": 0,
"Size": 103579269,
"VirtualSize": 103579269
},
{
"Containers": 5,
"Created": 1403128455,
"Id": "sha256:3e314f95dcace0f5e4fd37b10862fe8398e3c60ed36600bc0ca5fda78b087175",
"Labels": {},
"ParentId": "",
"RepoDigests": [
"ubuntu@sha256:002fba3e3255af10be97ea26e476692a7ebed0bb074a9ab960b2e7a1526b15d7",
"ubuntu@sha256:68ea0200f0b90df725d99d823905b04cf844f6039ef60c60bf3e019915017bd3"
],
"RepoTags": [
"ubuntu:12.10",
"ubuntu:quantal"
],
"SharedSize": 0,
"Size": 172064416,
"VirtualSize": 172064416
}
]Load a set of images and tags into a repository.
For details on the format, see the export image endpoint.
The image is loaded on all nodes in the swarm that are compatible with the image's architecture. For example, Windows images aren't loaded on Linux nodes, and vice-versa.
Images that were deleted
,Disk space reclaimed in bytes
The image ID of an image that was deleted
,The image ID of an image that was untagged
{
"ImagesDeleted": [
{
"Deleted": "string",
"Untagged": "string"
}
],
"SpaceReclaimed": 0
}Search for an image on Docker Hub.
[
{
"description": "",
"is_automated": false,
"is_official": false,
"name": "wma55/u1210sshd",
"star_count": 0
},
{
"description": "",
"is_automated": false,
"is_official": false,
"name": "jdswinbank/sshd",
"star_count": 0
},
{
"description": "",
"is_automated": false,
"is_official": false,
"name": "vgauthier/sshd",
"star_count": 0
}
]Remove an image, along with any untagged parent images that were referenced by that image.
Images can't be removed if they have descendant images, are being used by a running container or are being used by a build.
The image ID of an image that was deleted
,The image ID of an image that was untagged
[
{
"Untagged": "3e2f21a89f"
},
{
"Deleted": "3e2f21a89f"
},
{
"Deleted": "53b4f83ac9"
}
]Get a tarball containing all images and metadata for a repository.
If name is a specific name and tag (e.g. ubuntu:latest), then only that image (and its parents) are returned. If name is an image ID, similarly only that image (and its parents) are returned, but with the exclusion of the repositories file in the tarball, as there were no image names referenced.
An image tarball contains one directory per image layer (named using its long ID), each containing these files:
VERSION: currently 1.0 - the file format versionjson: detailed layer information, similar to docker inspect layer_idlayer.tar: A tarfile containing the filesystem changes in this layerThe layer.tar file contains aufs style .wh..wh.aufs files and directories for storing attribute changes and deletions.
If the tarball defines a repository, the tarball should also include a repositories file at the root that contains a list of repository and tag names mapped to layer IDs.
{
"hello-world": {
"latest": "565a9d68a73f6706862bfe8409a7f659776d4d60a8d096eb4a3cbce6999cc2a1"
}
}
Return parent layers of an image.
[
{
"Comment": "",
"Created": 1398108230,
"CreatedBy": "/bin/sh -c #(nop) ADD file:eb15dbd63394e063b805a3c32ca7bf0266ef64676d5a6fab4801f2e81e2a5148 in /",
"Id": "3db9c44f45209632d6050b35958829c3a2aa256d81b9a7be45b362ff85c54710",
"Size": 182964289,
"Tags": [
"ubuntu:lucid",
"ubuntu:10.04"
]
},
{
"Comment": "",
"Created": 1398108222,
"CreatedBy": "/bin/sh -c #(nop) MAINTAINER Tianon Gravi <admwiggin@gmail.com> - mkimage-debootstrap.sh -i iproute,iputils-ping,ubuntu-minimal -t lucid.tar.xz lucid http://archive.ubuntu.com/ubuntu/",
"Id": "6cfa4d1f33fb861d4d114f43b25abd0ac737509268065cdfd69d544a59c85ab8",
"Size": 0,
"Tags": []
},
{
"Comment": "Imported from -",
"Created": 1371157430,
"CreatedBy": "",
"Id": "511136ea3c5a64f264b78b5433614aec563103b4d4702f3ba7d4d2698e22c158",
"Size": 0,
"Tags": [
"scratch12:latest",
"scratch:latest"
]
}
]Return low-level information about an image.
Command is already escaped (Windows only)
,Whether to attach to stderr.
| boolean | |
|---|---|
| Default: | true |
Whether to attach to stdin.
| boolean | |
|---|---|
| Default: | false |
Whether to attach to stdout.
| boolean | |
|---|---|
| Default: | true |
Command to run specified as a string or an array of strings.
,The domain name to use for the container.
,The entry point for the container as a string or an array of strings.
If the array consists of exactly one empty string ([""]) then the entry point is reset to system default (i.e., the entry point used by docker when there is no ENTRYPOINT instruction in the Dockerfile).
A list of environment variables to set inside the container in the form ["VAR=value", ...]. A variable without = is removed from the environment, rather than to have an empty value.
An object mapping ports to an empty object in the form:
{"<port>/<tcp|udp>": {}}
The hostname to use for the container, as a valid RFC 1123 hostname.
,The name of the image to use when creating the container
,User-defined key/value metadata.
,MAC address of the container.
,Disable networking for the container.
,ONBUILD metadata that were defined in the image's Dockerfile.
Open stdin
| boolean | |
|---|---|
| Default: | false |
Shell for when RUN, CMD, and ENTRYPOINT uses a shell.
Close stdin after one attached client disconnects
| boolean | |
|---|---|
| Default: | false |
Signal to stop a container as a string or unsigned integer.
| string | |
|---|---|
| Default: | SIGTERM |
Timeout to stop a container in seconds.
| integer | |
|---|---|
| Default: | 10 |
Attach standard streams to a TTY, including stdin if it is not closed.
| boolean | |
|---|---|
| Default: | false |
The user that commands are run as inside the container.
,An object mapping mount point paths inside the container to empty objects.
,The working directory for commands to run in.
The time to wait between checks in nanoseconds. It should be 0 or at least 1000000 (1 ms). 0 means inherit.
,The number of consecutive failures needed to consider a container as unhealthy. 0 means inherit.
,Start period for the container to initialize before starting health-retries countdown in nanoseconds. It should be 0 or at least 1000000 (1 ms). 0 means inherit.
,The test to perform. Possible values are:
[] inherit healthcheck from image or parent image["NONE"] disable healthcheck["CMD", args...] exec arguments directly["CMD-SHELL", command] run command with system's default shellThe time to wait before considering the check to have hung. It should be 0 or at least 1000000 (1 ms). 0 means inherit.
| object | |
|---|---|
| Default: | [object Object] |
| Enum: | "[object Object]" |
{
"Architecture": "amd64",
"Author": "",
"Comment": "",
"Config": {
"AttachStderr": false,
"AttachStdin": false,
"AttachStdout": false,
"Cmd": [
"/bin/bash"
],
"Domainname": "",
"Env": [
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
],
"Hostname": "e611e15f9c9d",
"Image": "91e54dfb11794fad694460162bf0cb0a4fa710cfa3f60979c177d920813e267c",
"Labels": {
"com.example.license": "GPL",
"com.example.vendor": "Acme",
"com.example.version": "1.0"
},
"MacAddress": "",
"NetworkDisabled": false,
"OnBuild": [],
"OpenStdin": false,
"PublishService": "",
"StdinOnce": false,
"Tty": false,
"User": "",
"WorkingDir": ""
},
"Container": "cb91e48a60d01f1e27028b4fc6819f4f290b3cf12496c8176ec714d0d390984a",
"ContainerConfig": {
"AttachStderr": false,
"AttachStdin": false,
"AttachStdout": false,
"Cmd": [
"/bin/sh",
"-c",
"#(nop) LABEL com.example.vendor=Acme com.example.license=GPL com.example.version=1.0"
],
"Domainname": "",
"Env": [
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
],
"Hostname": "e611e15f9c9d",
"Image": "91e54dfb11794fad694460162bf0cb0a4fa710cfa3f60979c177d920813e267c",
"Labels": {
"com.example.license": "GPL",
"com.example.vendor": "Acme",
"com.example.version": "1.0"
},
"MacAddress": "",
"NetworkDisabled": false,
"OnBuild": [],
"OpenStdin": false,
"PublishService": "",
"StdinOnce": false,
"Tty": false,
"User": "",
"WorkingDir": ""
},
"Created": "2015-09-10T08:30:53.26995814Z",
"DockerVersion": "1.9.0-dev",
"GraphDriver": {
"Data": {},
"Name": "aufs"
},
"Id": "sha256:85f05633ddc1c50679be2b16a0479ab6f7637f8884e0cfe0f4d20e1ebb3d6e7c",
"Os": "linux",
"Parent": "sha256:91e54dfb11794fad694460162bf0cb0a4fa710cfa3f60979c177d920813e267c",
"RepoDigests": [
"localhost:5000/test/busybox/example@sha256:cbbf2f9a99b47fc460d422812b6a5adff7dfee951d8fa2e4a98caa0382cfbdbf"
],
"RepoTags": [
"example:1.0",
"example:latest",
"example:stable"
],
"RootFS": {
"Layers": [
"sha256:1834950e52ce4d5a88a1bbd131c537f4d0e56d10ff0dd69e66be3b7dfa9df7e6",
"sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef"
],
"Type": "layers"
},
"Size": 0,
"VirtualSize": 188359297
}Push an image to a registry.
If you wish to push an image on to a private registry, that image must already have a tag which references the registry. For example, registry.example.com/myimage:latest.
The push is cancelled if the HTTP connection is closed.
Tag an image so that it becomes part of a repository.
Returns a list of networks. For details on the format, see the network inspect endpoint.
Note that it uses a different, smaller representation of a network than inspecting a single network. For example, the list of containers attached to the network is not propagated in API versions 1.28 and up.
Node-specific networks, like those with bridge and third-party drivers, are prefixed with the node name.
List of IPAM configuration options, specified as a map: {"Subnet": <cidr>, "IPRange": <cidr>, "Gateway": <ip address="">, "AuxAddress": <device_name:ip address="">}
Name of the IPAM driver to use.
| string | |
|---|---|
| Default: | default |
Driver-specific options, specified as a map.
[
{
"Attachable": false,
"Created": "2016-10-19T06:21:00.416543526Z",
"Driver": "bridge",
"EnableIPv6": false,
"IPAM": {
"Config": [
{
"Subnet": "172.17.0.0/16"
}
],
"Driver": "default"
},
"Id": "f2de39df4171b0dc801e8002d1d999b77256983dfc63041c0f34030aa3977566",
"Ingress": false,
"Internal": false,
"Name": "bridge",
"Options": {
"com.docker.network.bridge.default_bridge": "true",
"com.docker.network.bridge.enable_icc": "true",
"com.docker.network.bridge.enable_ip_masquerade": "true",
"com.docker.network.bridge.host_binding_ipv4": "0.0.0.0",
"com.docker.network.bridge.name": "docker0",
"com.docker.network.driver.mtu": "1500"
},
"Scope": "local"
},
{
"Attachable": false,
"Containers": {},
"Created": "0001-01-01T00:00:00Z",
"Driver": "null",
"EnableIPv6": false,
"IPAM": {
"Config": [],
"Driver": "default"
},
"Id": "e086a3893b05ab69242d3c44e49483a3bbbd3a26b46baa8f61ab797c1088d794",
"Ingress": false,
"Internal": false,
"Name": "none",
"Options": {},
"Scope": "local"
},
{
"Attachable": false,
"Containers": {},
"Created": "0001-01-01T00:00:00Z",
"Driver": "host",
"EnableIPv6": false,
"IPAM": {
"Config": [],
"Driver": "default"
},
"Id": "13e871235c677f196c4e1ecebb9dc733b9b2d2ab589e30c539efeda84a24215e",
"Ingress": false,
"Internal": false,
"Name": "host",
"Options": {},
"Scope": "local"
}
]If the name is prefixed with the name of a node, the create request is sent to the specified node. Use the '/' character to separate the node name, like testnode/testnet.
The ID of the created network.
,{
"Id": "22be93d5babb089c5aab8dbc369042fad48ff791584ca2da2100db837a1c7c30",
"Warning": ""
}Not supported on UCP.
Networks that were deleted
{
"NetworksDeleted": [
"string"
]
}Node-specific networks, like those with bridge and third-party drivers, are prefixed with the node name.
List of IPAM configuration options, specified as a map: {"Subnet": <cidr>, "IPRange": <cidr>, "Gateway": <ip address="">, "AuxAddress": <device_name:ip address="">}
Name of the IPAM driver to use.
| string | |
|---|---|
| Default: | default |
Driver-specific options, specified as a map.
{
"Attachable": false,
"Containers": {
"19a4d5d687db25203351ed79d478946f861258f018fe384f229f2efa4b23513c": {
"EndpointID": "628cadb8bcb92de107b2a1e516cbffe463e321f548feb37697cce00ad694f21a",
"IPv4Address": "172.19.0.2/16",
"IPv6Address": "",
"MacAddress": "02:42:ac:13:00:02",
"Name": "test"
}
},
"Created": "2016-10-19T04:33:30.360899459Z",
"Driver": "bridge",
"EnableIPv6": false,
"IPAM": {
"Config": [
{
"Gateway": "172.19.0.1",
"Subnet": "172.19.0.0/16"
}
],
"Driver": "default",
"Options": {
"foo": "bar"
}
},
"Id": "7d86d31b1478e7cca9ebed7e73aa0fdeec46c5ca29497431d3007d2d9e15ed99",
"Ingress": false,
"Internal": false,
"Labels": {
"com.example.some-label": "some-value",
"com.example.some-other-label": "some-other-value"
},
"Name": "net01",
"Options": {
"com.docker.network.bridge.default_bridge": "true",
"com.docker.network.bridge.enable_icc": "true",
"com.docker.network.bridge.enable_ip_masquerade": "true",
"com.docker.network.bridge.host_binding_ipv4": "0.0.0.0",
"com.docker.network.bridge.name": "docker0",
"com.docker.network.driver.mtu": "1500"
},
"Scope": "local"
}UCP augments the Status.State based on the status of the UCP components running on the current node.
Availability of the node.
= ['active', 'pause', 'drain']| string | |
|---|---|
| Enum: | "active", "pause", "drain" |
User-defined key/value metadata.
,Name for the node.
,Role of the node.
= ['worker', 'manager']| string | |
|---|---|
| Enum: | "worker", "manager" |
CA configuration.
,Dispatcher configuration.
,Parameters related to encryption-at-rest.
,User-defined key/value metadata.
,Name of the swarm.
,Orchestration configuration.
,Raft configuration.
,Defaults for creating tasks in this cluster.
Configuration for forwarding signing requests to an external certificate authority.
,An integer whose purpose is to force swarm to generate a new signing CA certificate and key, if none have been specified in SigningCACert and SigningCAKey
The duration node certificates are issued for.
,The desired signing CA certificate for all swarm node TLS leaf certificates, in PEM format.
,The desired signing CA key for all swarm node TLS leaf certificates, in PEM format.
The delay for an agent to send a heartbeat to the dispatcher.
If set, generate a key and use it to lock data stored on the managers.
The number of historic tasks to keep per instance or node. If negative, never remove completed or failed tasks.
The number of ticks that a follower will wait for a message from the leader before becoming a candidate and starting an election. ElectionTick must be greater than HeartbeatTick.
A tick currently defaults to one second, so these translate directly to seconds currently, but this is NOT guaranteed.
,The number of ticks between heartbeats. Every HeartbeatTick ticks, the leader will send a heartbeat to the followers.
A tick currently defaults to one second, so these translate directly to seconds currently, but this is NOT guaranteed.
,The number of snapshots to keep beyond the current snapshot.
,The number of log entries to keep around to sync up slow followers after a snapshot is created.
,The number of log entries between snapshots.
The log driver to use for tasks created in the orchestrator if unspecified by a service.
Updating this value will only have an affect on new tasks. Old tasks will continue use their previously configured log driver until recreated.
The root CA certificate (in PEM format) this external CA uses to issue TLS certificates (assumed to be to the current swarm root CA certificate if not provided).
,An object with key/value pairs that are interpreted as protocol-specific options for the external CA driver.
,Protocol for communication with the external CA (currently only cfssl is supported).
| string | |
|---|---|
| Default: | cfssl |
| Enum: | "cfssl" |
URL where certificate signing requests should be sent.
[
{
"CreatedAt": "2016-06-07T20:31:11.853781916Z",
"Description": {
"Engine": {
"EngineVersion": "17.04.0",
"Labels": {
"foo": "bar"
},
"Plugins": [
{
"Name": "local",
"Type": "Volume"
},
{
"Name": "bridge",
"Type": "Network"
},
{
"Name": "null",
"Type": "Network"
},
{
"Name": "overlay",
"Type": "Network"
}
]
},
"Hostname": "bf3067039e47",
"Platform": {
"Architecture": "x86_64",
"OS": "linux"
},
"Resources": {
"MemoryBytes": 8272408576,
"NanoCPUs": 4000000000
}
},
"ID": "24ifsmvkjbyhk",
"ManagerStatus": {
"Addr": "172.17.0.2:2377",
"Leader": true,
"Reachability": "reachable"
},
"Spec": {
"Availability": "active",
"Labels": {
"foo": "bar"
},
"Name": "my-node",
"Role": "manager"
},
"Status": {
"Addr": "172.17.0.2",
"State": "ready"
},
"TLSInfo": {
"CertIssuerPublicKey": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEmT9XIw9h1qoNclv9VeHmf/Vi6/uI2vFXdBveXTpcPjqx6i9wNazchk1XWV/dKTKvSh9xyGKmiIeRcE4OiMnJ1A==",
"CertIssuerSubject": "MBMxETAPBgNVBAMTCHN3YXJtLWNh",
"TrustRoot": "-----BEGIN CERTIFICATE-----\nMIIBajCCARCgAwIBAgIUbYqrLSOSQHoxD8CwG6Bi2PJi9c8wCgYIKoZIzj0EAwIw\nEzERMA8GA1UEAxMIc3dhcm0tY2EwHhcNMTcwNDI0MjE0MzAwWhcNMzcwNDE5MjE0\nMzAwWjATMREwDwYDVQQDEwhzd2FybS1jYTBZMBMGByqGSM49AgEGCCqGSM49AwEH\nA0IABJk/VyMPYdaqDXJb/VXh5n/1Yuv7iNrxV3Qb3l06XD46seovcDWs3IZNV1lf\n3Skyr0ofcchipoiHkXBODojJydSjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMB\nAf8EBTADAQH/MB0GA1UdDgQWBBRUXxuRcnFjDfR/RIAUQab8ZV/n4jAKBggqhkjO\nPQQDAgNIADBFAiAy+JTe6Uc3KyLCMiqGl2GyWGQqQDEcO3/YG36x7om65AIhAJvz\npxv6zFeVEkAEEkqIYi0omA9+CjanB/6Bz4n1uw8H\n-----END CERTIFICATE-----\n"
},
"UpdatedAt": "2016-06-07T20:31:11.999868824Z",
"Version": {
"Index": 8
}
}
]If the current node is a manager, to keep the system healthy UCP attempts to unwind swarm components, like the KV store and auth store, from the node.
UCP augments the Status.State based on the status of the UCP components running on the current node.
Availability of the node.
= ['active', 'pause', 'drain']| string | |
|---|---|
| Enum: | "active", "pause", "drain" |
User-defined key/value metadata.
,Name for the node.
,Role of the node.
= ['worker', 'manager']| string | |
|---|---|
| Enum: | "worker", "manager" |
CA configuration.
,Dispatcher configuration.
,Parameters related to encryption-at-rest.
,User-defined key/value metadata.
,Name of the swarm.
,Orchestration configuration.
,Raft configuration.
,Defaults for creating tasks in this cluster.
Configuration for forwarding signing requests to an external certificate authority.
,An integer whose purpose is to force swarm to generate a new signing CA certificate and key, if none have been specified in SigningCACert and SigningCAKey
The duration node certificates are issued for.
,The desired signing CA certificate for all swarm node TLS leaf certificates, in PEM format.
,The desired signing CA key for all swarm node TLS leaf certificates, in PEM format.
The delay for an agent to send a heartbeat to the dispatcher.
If set, generate a key and use it to lock data stored on the managers.
The number of historic tasks to keep per instance or node. If negative, never remove completed or failed tasks.
The number of ticks that a follower will wait for a message from the leader before becoming a candidate and starting an election. ElectionTick must be greater than HeartbeatTick.
A tick currently defaults to one second, so these translate directly to seconds currently, but this is NOT guaranteed.
,The number of ticks between heartbeats. Every HeartbeatTick ticks, the leader will send a heartbeat to the followers.
A tick currently defaults to one second, so these translate directly to seconds currently, but this is NOT guaranteed.
,The number of snapshots to keep beyond the current snapshot.
,The number of log entries to keep around to sync up slow followers after a snapshot is created.
,The number of log entries between snapshots.
The log driver to use for tasks created in the orchestrator if unspecified by a service.
Updating this value will only have an affect on new tasks. Old tasks will continue use their previously configured log driver until recreated.
The root CA certificate (in PEM format) this external CA uses to issue TLS certificates (assumed to be to the current swarm root CA certificate if not provided).
,An object with key/value pairs that are interpreted as protocol-specific options for the external CA driver.
,Protocol for communication with the external CA (currently only cfssl is supported).
| string | |
|---|---|
| Default: | cfssl |
| Enum: | "cfssl" |
URL where certificate signing requests should be sent.
{
"CreatedAt": "2016-06-07T20:31:11.853781916Z",
"Description": {
"Engine": {
"EngineVersion": "17.04.0",
"Labels": {
"foo": "bar"
},
"Plugins": [
{
"Name": "local",
"Type": "Volume"
},
{
"Name": "bridge",
"Type": "Network"
},
{
"Name": "null",
"Type": "Network"
},
{
"Name": "overlay",
"Type": "Network"
}
]
},
"Hostname": "bf3067039e47",
"Platform": {
"Architecture": "x86_64",
"OS": "linux"
},
"Resources": {
"MemoryBytes": 8272408576,
"NanoCPUs": 4000000000
}
},
"ID": "24ifsmvkjbyhk",
"ManagerStatus": {
"Addr": "172.17.0.2:2377",
"Leader": true,
"Reachability": "reachable"
},
"Spec": {
"Availability": "active",
"Labels": {
"foo": "bar"
},
"Name": "my-node",
"Role": "manager"
},
"Status": {
"Addr": "172.17.0.2",
"State": "ready"
},
"TLSInfo": {
"CertIssuerPublicKey": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEmT9XIw9h1qoNclv9VeHmf/Vi6/uI2vFXdBveXTpcPjqx6i9wNazchk1XWV/dKTKvSh9xyGKmiIeRcE4OiMnJ1A==",
"CertIssuerSubject": "MBMxETAPBgNVBAMTCHN3YXJtLWNh",
"TrustRoot": "-----BEGIN CERTIFICATE-----\nMIIBajCCARCgAwIBAgIUbYqrLSOSQHoxD8CwG6Bi2PJi9c8wCgYIKoZIzj0EAwIw\nEzERMA8GA1UEAxMIc3dhcm0tY2EwHhcNMTcwNDI0MjE0MzAwWhcNMzcwNDE5MjE0\nMzAwWjATMREwDwYDVQQDEwhzd2FybS1jYTBZMBMGByqGSM49AgEGCCqGSM49AwEH\nA0IABJk/VyMPYdaqDXJb/VXh5n/1Yuv7iNrxV3Qb3l06XD46seovcDWs3IZNV1lf\n3Skyr0ofcchipoiHkXBODojJydSjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMB\nAf8EBTADAQH/MB0GA1UdDgQWBBRUXxuRcnFjDfR/RIAUQab8ZV/n4jAKBggqhkjO\nPQQDAgNIADBFAiAy+JTe6Uc3KyLCMiqGl2GyWGQqQDEcO3/YG36x7om65AIhAJvz\npxv6zFeVEkAEEkqIYi0omA9+CjanB/6Bz4n1uw8H\n-----END CERTIFICATE-----\n"
},
"UpdatedAt": "2016-06-07T20:31:11.999868824Z",
"Version": {
"Index": 8
}
}Get options for syncing admin members of an organization. Requires authentication and authorization as an admin user or an admin member of the organization.
Whether to enable LDAP syncing. If false, all other fields are ignored
,The distinguished name of the LDAP group. Applicable only if selectGroupMembers is true, ignored otherwise
,The name of the LDAP group entry attribute which corresponds to distinguished names of members. Applicable only if selectGroupMembers is true, ignored otherwise
,The distinguished name of the element from which the LDAP server will search for users. Applicable only if selectGroupMembers is false, ignored otherwise
,The LDAP search filter used to select users if selectGroupMembers is false, may be left blank
,Whether to search for users in the entire subtree of the base DN or to only search one level under the base DN (if false). Applicable only if selectGroupMembers is false, ignored otherwise
,Whether to sync using a group DN and member attribute selection or to use a search filter (if false)
{
"enableSync": true,
"groupDN": "string",
"groupMemberAttr": "string",
"searchBaseDN": "string",
"searchFilter": "string",
"searchScopeSubtree": true,
"selectGroupMembers": true
}Set options for syncing admin members of an organization. Enabling sync of organization admin members will disable the ability to directly manage organization membership for any users imported from an LDAP directory. Their organization membership is instead set by being synced as an admin member of the organization or by being a member of any team within the organization. Requires authentication and authorization as an admin user or an admin member of the organization.
Whether to enable LDAP syncing. If false, all other fields are ignored
,The distinguished name of the LDAP group. Applicable only if selectGroupMembers is true, ignored otherwise
,The name of the LDAP group entry attribute which corresponds to distinguished names of members. Applicable only if selectGroupMembers is true, ignored otherwise
,The distinguished name of the element from which the LDAP server will search for users. Applicable only if selectGroupMembers is false, ignored otherwise
,The LDAP search filter used to select users if selectGroupMembers is false, may be left blank
,Whether to search for users in the entire subtree of the base DN or to only search one level under the base DN (if false). Applicable only if selectGroupMembers is false, ignored otherwise
,Whether to sync using a group DN and member attribute selection or to use a search filter (if false)
{
"enableSync": true,
"groupDN": "string",
"groupMemberAttr": "string",
"searchBaseDN": "string",
"searchFilter": "string",
"searchScopeSubtree": true,
"selectGroupMembers": true
}List members of an organization. Lists memberships in ascending order by user ID. Requires authentication and authorization as an admin user or a member of the organization.
Whether the member is an admin of the organization or team
,The user which is a member of the organization or team
Full Name of the account
,ID of the account
,Whether the user is active and can login (users only)
,Whether the user is a system admin (users only)
,Whether the user was imported from an upstream identity provider
,Whether the account is an organization (or user)
,The number of members of the organization
,Name of the account
{
"members": [
{
"isAdmin": true,
"member": {
"fullName": "string",
"id": "string",
"isActive": true,
"isAdmin": true,
"isImported": true,
"isOrg": true,
"membersCount": 0,
"name": "string"
}
}
]
}Remove a user from an organization. Removing a member of the organization will also remove them from any teams in the organization. If organization admin members are configured to be synced with LDAP, users which are imported from LDAP cannot be manually removed as members of the organization and must be either synced as an organization admin member or removed as a member of all teams within the organization. Requires authentication and authorization as an admin user or an admin member of the organization.
Details of a user's membership in an organization. Requires authentication and authorization as an admin user, a member of the organization, or the target user.
Whether the member is an admin of the organization or team
,The user which is a member of the organization or team
Full Name of the account
,ID of the account
,Whether the user is active and can login (users only)
,Whether the user is a system admin (users only)
,Whether the user was imported from an upstream identity provider
,Whether the account is an organization (or user)
,The number of members of the organization
,Name of the account
{
"isAdmin": true,
"member": {
"fullName": "string",
"id": "string",
"isActive": true,
"isAdmin": true,
"isImported": true,
"isOrg": true,
"membersCount": 0,
"name": "string"
}
}Add a user to an organization. If organization admin members are configured to be synced with LDAP, users which are imported from LDAP cannot be manually added as members of the organization and must be either synced as an organization admin member or be added as a member of team within the organization. Requires authentication and authorization as an admin user or an admin member of the organization
Whether the member is an admin of the organization or team
,The user which is a member of the organization or team
Full Name of the account
,ID of the account
,Whether the user is active and can login (users only)
,Whether the user is a system admin (users only)
,Whether the user was imported from an upstream identity provider
,Whether the account is an organization (or user)
,The number of members of the organization
,Name of the account
{
"isAdmin": true,
"member": {
"fullName": "string",
"id": "string",
"isActive": true,
"isAdmin": true,
"isImported": true,
"isOrg": true,
"membersCount": 0,
"name": "string"
}
}List a user's team membership in an organization. Lists team memberships in ascending order by team ID. Requires authentication and authorization as an admin user or a member of the organization.
Whether the user is an admin of the team
,The team which the user is a member of
Description of the team
,ID of the team
,The number of members of the team
,Name of the team
,ID of the organization to which this team belongs
{
"memberTeams": [
{
"isAdmin": true,
"team": {
"description": "string",
"id": "string",
"membersCount": 0,
"name": "string",
"orgID": "string"
}
}
]
}Get options for syncing admin members of an organization. Requires authentication and authorization as an admin user or an admin member of the organization.
Whether to enable LDAP syncing. If false, all other fields are ignored
,The distinguished name of the LDAP group. Applicable only if selectGroupMembers is true, ignored otherwise
,The name of the LDAP group entry attribute which corresponds to distinguished names of members. Applicable only if selectGroupMembers is true, ignored otherwise
,The distinguished name of the element from which the LDAP server will search for users. Applicable only if selectGroupMembers is false, ignored otherwise
,The LDAP search filter used to select users if selectGroupMembers is false, may be left blank
,Whether to search for users in the entire subtree of the base DN or to only search one level under the base DN (if false). Applicable only if selectGroupMembers is false, ignored otherwise
,Whether to sync using a group DN and member attribute selection or to use a search filter (if false)
{
"enableSync": true,
"groupDN": "string",
"groupMemberAttr": "string",
"searchBaseDN": "string",
"searchFilter": "string",
"searchScopeSubtree": true,
"selectGroupMembers": true
}Set options for syncing admin members of an organization. Enabling sync of organization admin members will disable the ability to directly manage organization membership for any users imported from an LDAP directory. Their organization membership is instead set by being synced as an admin member of the organization or by being a member of any team within the organization. Requires authentication and authorization as an admin user or an admin member of the organization.
Whether to enable LDAP syncing. If false, all other fields are ignored
,The distinguished name of the LDAP group. Applicable only if selectGroupMembers is true, ignored otherwise
,The name of the LDAP group entry attribute which corresponds to distinguished names of members. Applicable only if selectGroupMembers is true, ignored otherwise
,The distinguished name of the element from which the LDAP server will search for users. Applicable only if selectGroupMembers is false, ignored otherwise
,The LDAP search filter used to select users if selectGroupMembers is false, may be left blank
,Whether to search for users in the entire subtree of the base DN or to only search one level under the base DN (if false). Applicable only if selectGroupMembers is false, ignored otherwise
,Whether to sync using a group DN and member attribute selection or to use a search filter (if false)
{
"enableSync": true,
"groupDN": "string",
"groupMemberAttr": "string",
"searchBaseDN": "string",
"searchFilter": "string",
"searchScopeSubtree": true,
"selectGroupMembers": true
}List members of an organization. Lists memberships in ascending order by user ID. Requires authentication and authorization as an admin user or a member of the organization.
Whether the member is an admin of the organization or team
,The user which is a member of the organization or team
Full Name of the account
,ID of the account
,Whether the user is active and can login (users only)
,Whether the user is a system admin (users only)
,Whether the user was imported from an upstream identity provider
,Whether the account is an organization (or user)
,The number of members of the organization
,Name of the account
{
"members": [
{
"isAdmin": true,
"member": {
"fullName": "string",
"id": "string",
"isActive": true,
"isAdmin": true,
"isImported": true,
"isOrg": true,
"membersCount": 0,
"name": "string"
}
}
]
}Remove a user from an organization. Removing a member of the organization will also remove them from any teams in the organization. If organization admin members are configured to be synced with LDAP, users which are imported from LDAP cannot be manually removed as members of the organization and must be either synced as an organization admin member or removed as a member of all teams within the organization. Requires authentication and authorization as an admin user or an admin member of the organization.
Details of a user's membership in an organization. Requires authentication and authorization as an admin user, a member of the organization, or the target user.
Whether the member is an admin of the organization or team
,The user which is a member of the organization or team
Full Name of the account
,ID of the account
,Whether the user is active and can login (users only)
,Whether the user is a system admin (users only)
,Whether the user was imported from an upstream identity provider
,Whether the account is an organization (or user)
,The number of members of the organization
,Name of the account
{
"isAdmin": true,
"member": {
"fullName": "string",
"id": "string",
"isActive": true,
"isAdmin": true,
"isImported": true,
"isOrg": true,
"membersCount": 0,
"name": "string"
}
}Add a user to an organization. If organization admin members are configured to be synced with LDAP, users which are imported from LDAP cannot be manually added as members of the organization and must be either synced as an organization admin member or be added as a member of team within the organization. Requires authentication and authorization as an admin user or an admin member of the organization
Whether the member is an admin of the organization or team
,The user which is a member of the organization or team
Full Name of the account
,ID of the account
,Whether the user is active and can login (users only)
,Whether the user is a system admin (users only)
,Whether the user was imported from an upstream identity provider
,Whether the account is an organization (or user)
,The number of members of the organization
,Name of the account
{
"isAdmin": true,
"member": {
"fullName": "string",
"id": "string",
"isActive": true,
"isAdmin": true,
"isImported": true,
"isOrg": true,
"membersCount": 0,
"name": "string"
}
}List a user's team membership in an organization. Lists team memberships in ascending order by team ID. Requires authentication and authorization as an admin user or a member of the organization.
Whether the user is an admin of the team
,The team which the user is a member of
Description of the team
,ID of the team
,The number of members of the team
,Name of the team
,ID of the organization to which this team belongs
{
"memberTeams": [
{
"isAdmin": true,
"team": {
"description": "string",
"id": "string",
"membersCount": 0,
"name": "string",
"orgID": "string"
}
}
]
}List teams in an organization. Lists teams in ascending order by name. Requires authentication and authorization as an admin user or a member of the organization.
Description of the team
,ID of the team
,The number of members of the team
,Name of the team
,ID of the organization to which this team belongs
{
"teams": [
{
"description": "string",
"id": "string",
"membersCount": 0,
"name": "string",
"orgID": "string"
}
]
}Create a team. Requires authentication and authorization as an admin user or an admin member of the organization.
Description of the team
,ID of the team
,The number of members of the team
,Name of the team
,ID of the organization to which this team belongs
{
"description": "string",
"id": "string",
"membersCount": 0,
"name": "string",
"orgID": "string"
}Delete a team. Requires authentication and authorization as an admin user or an admin member of the organization.
Details for a team. Requires authentication and authorization as an admin user or a member of the organization.
Description of the team
,ID of the team
,The number of members of the team
,Name of the team
,ID of the organization to which this team belongs
{
"description": "string",
"id": "string",
"membersCount": 0,
"name": "string",
"orgID": "string"
}Update details for a team. Requires authentication and authorization as an admin user, an admin member of the organization, or an admin member of the team.
Description of the team
,ID of the team
,The number of members of the team
,Name of the team
,ID of the organization to which this team belongs
{
"description": "string",
"id": "string",
"membersCount": 0,
"name": "string",
"orgID": "string"
}Get options for syncing members of a team. Requires authentication and authorization as an admin user, an admin member of the organization, or an admin member of the team.
Whether to enable LDAP syncing. If false, all other fields are ignored
,The distinguished name of the LDAP group. Applicable only if selectGroupMembers is true, ignored otherwise
,The name of the LDAP group entry attribute which corresponds to distinguished names of members. Applicable only if selectGroupMembers is true, ignored otherwise
,The distinguished name of the element from which the LDAP server will search for users. Applicable only if selectGroupMembers is false, ignored otherwise
,The LDAP search filter used to select users if selectGroupMembers is false, may be left blank
,Whether to search for users in the entire subtree of the base DN or to only search one level under the base DN (if false). Applicable only if selectGroupMembers is false, ignored otherwise
,Whether to sync using a group DN and member attribute selection or to use a search filter (if false)
{
"enableSync": true,
"groupDN": "string",
"groupMemberAttr": "string",
"searchBaseDN": "string",
"searchFilter": "string",
"searchScopeSubtree": true,
"selectGroupMembers": true
}Set options for syncing members of a team. Enabling sync of team members will disable the ability to manually manage team membership for any users imported from LDAP. Their team membership is instead managed by the LDAP sync. Requires authentication and authorization as an admin user, an admin member of the organization, or an admin member of the team.
Whether to enable LDAP syncing. If false, all other fields are ignored
,The distinguished name of the LDAP group. Applicable only if selectGroupMembers is true, ignored otherwise
,The name of the LDAP group entry attribute which corresponds to distinguished names of members. Applicable only if selectGroupMembers is true, ignored otherwise
,The distinguished name of the element from which the LDAP server will search for users. Applicable only if selectGroupMembers is false, ignored otherwise
,The LDAP search filter used to select users if selectGroupMembers is false, may be left blank
,Whether to search for users in the entire subtree of the base DN or to only search one level under the base DN (if false). Applicable only if selectGroupMembers is false, ignored otherwise
,Whether to sync using a group DN and member attribute selection or to use a search filter (if false)
{
"enableSync": true,
"groupDN": "string",
"groupMemberAttr": "string",
"searchBaseDN": "string",
"searchFilter": "string",
"searchScopeSubtree": true,
"selectGroupMembers": true
}List members of a team. Lists memberships in ascending order by user ID. Requires authentication and authorization as an admin user or a member of the organization.
Whether the member is an admin of the organization or team
,The user which is a member of the organization or team
Full Name of the account
,ID of the account
,Whether the user is active and can login (users only)
,Whether the user is a system admin (users only)
,Whether the user was imported from an upstream identity provider
,Whether the account is an organization (or user)
,The number of members of the organization
,Name of the account
{
"members": [
{
"isAdmin": true,
"member": {
"fullName": "string",
"id": "string",
"isActive": true,
"isAdmin": true,
"isImported": true,
"isOrg": true,
"membersCount": 0,
"name": "string"
}
}
]
}Remove a member from a team. The user will remain a member of the organization. If team members are configured to be synced with LDAP, users which are imported from LDAP cannot be manually removed as members of the team and must be synced with LDAP. Requires authentication and authorization as an admin user, an admin member of the organization, or an admin member of the team.
Details of a user's membership in a team. Requires authentication and authorization as an admin user or a member of the organization.
Whether the member is an admin of the organization or team
,The user which is a member of the organization or team
Full Name of the account
,ID of the account
,Whether the user is active and can login (users only)
,Whether the user is a system admin (users only)
,Whether the user was imported from an upstream identity provider
,Whether the account is an organization (or user)
,The number of members of the organization
,Name of the account
{
"isAdmin": true,
"member": {
"fullName": "string",
"id": "string",
"isActive": true,
"isAdmin": true,
"isImported": true,
"isOrg": true,
"membersCount": 0,
"name": "string"
}
}Add a user to a team. The user will be added as a member of the organization if they are not already. If team members are configured to be synced with LDAP, users which are imported from LDAP cannot be manually added as members of the team and must be synced with LDAP. Requires authentication and authorization as an admin user, an admin member of the organization, or an admin member of the team.
Whether the member is an admin of the organization or team
,The user which is a member of the organization or team
Full Name of the account
,ID of the account
,Whether the user is active and can login (users only)
,Whether the user is a system admin (users only)
,Whether the user was imported from an upstream identity provider
,Whether the account is an organization (or user)
,The number of members of the organization
,Name of the account
{
"isAdmin": true,
"member": {
"fullName": "string",
"id": "string",
"isActive": true,
"isAdmin": true,
"isImported": true,
"isOrg": true,
"membersCount": 0,
"name": "string"
}
}Returns information about installed plugins.
NOTE: This API endpoint does not work through the UCP API. Admins can use this API directly on each individual node's Docker daemon.
The config of a plugin.
,True if the plugin is running. False if the plugin is not running, only installed.
,plugin remote reference used to push/pull the plugin
,Settings that can be modified by users.
Docker Version used to create the plugin
,The interface between Docker and the plugin
,[
{
"Config": {
"Args": {
"Description": "command line arguments",
"Name": "args",
"Settable": [
"string"
],
"Value": [
"string"
]
},
"Description": "A sample volume plugin for Docker",
"DockerVersion": "17.06.0-ce",
"Documentation": "https://docs.docker.com/engine/extend/plugins/",
"Entrypoint": [
"/usr/bin/sample-volume-plugin",
"/data"
],
"Env": [
{
"Description": "If set, prints debug messages",
"Name": "DEBUG",
"Settable": "",
"Value": "0"
}
],
"Interface": {
"Socket": "plugins.sock",
"Types": [
"docker.volumedriver/1.0"
]
},
"IpcHost": true,
"Linux": {
"AllowAllDevices": true,
"Capabilities": [
"CAP_SYS_ADMIN",
"CAP_SYSLOG"
],
"Devices": [
{
"Description": "string",
"Name": "string",
"Path": "/dev/fuse",
"Settable": [
"string"
]
}
]
},
"Mounts": [
{
"Description": "This is a mount that's used by the plugin.",
"Destination": "/mnt/state",
"Name": "some-mount",
"Options": [
"rbind",
"rw"
],
"Settable": [
"string"
],
"Source": "/var/lib/docker/plugins/",
"Type": "bind"
}
],
"Network": {
"Type": "host"
},
"PidHost": true,
"PropagatedMount": "/mnt/volumes",
"User": {
"GID": 1000,
"UID": 1000
},
"WorkDir": "/bin/",
"rootfs": {
"diff_ids": [
"sha256:675532206fbf3030b8458f88d6e26d4eb1577688a25efec97154c94e8b6b4887",
"sha256:e216a057b1cb1efc11f8a268f37ef62083e70b1b38323ba252e25ac88904a7e8"
],
"type": "layers"
}
},
"Enabled": true,
"Id": "5724e2c8652da337ab2eedd19fc6fc0ec908e4bd907c7421bf6a8dfc70c4c078",
"Name": "tiborvass/sample-volume-plugin",
"PluginReference": "localhost:5000/tiborvass/sample-volume-plugin:latest",
"Settings": {
"Args": [
"string"
],
"Devices": [
{
"Description": "string",
"Name": "string",
"Path": "/dev/fuse",
"Settable": [
"string"
]
}
],
"Env": [
"DEBUG=0"
],
"Mounts": [
{
"Description": "This is a mount that's used by the plugin.",
"Destination": "/mnt/state",
"Name": "some-mount",
"Options": [
"rbind",
"rw"
],
"Settable": [
"string"
],
"Source": "/var/lib/docker/plugins/",
"Type": "bind"
}
]
}
}
]NOTE: This API endpoint does not work through the UCP API. Admins can use this API directly on each individual node's Docker daemon.
Pulls and installs a plugin. After the plugin is installed, it can be enabled using the POST /plugins/{name}/enable endpoint.
NOTE: This API endpoint does not work through the UCP API. Admins can use this API directly on each individual node's Docker daemon.
NOTE: This API endpoint does not work through the UCP API. Admins can use this API directly on each individual node's Docker daemon.
The config of a plugin.
,True if the plugin is running. False if the plugin is not running, only installed.
,plugin remote reference used to push/pull the plugin
,Settings that can be modified by users.
Docker Version used to create the plugin
,The interface between Docker and the plugin
,{
"Config": {
"Args": {
"Description": "command line arguments",
"Name": "args",
"Settable": [
"string"
],
"Value": [
"string"
]
},
"Description": "A sample volume plugin for Docker",
"DockerVersion": "17.06.0-ce",
"Documentation": "https://docs.docker.com/engine/extend/plugins/",
"Entrypoint": [
"/usr/bin/sample-volume-plugin",
"/data"
],
"Env": [
{
"Description": "If set, prints debug messages",
"Name": "DEBUG",
"Settable": "",
"Value": "0"
}
],
"Interface": {
"Socket": "plugins.sock",
"Types": [
"docker.volumedriver/1.0"
]
},
"IpcHost": true,
"Linux": {
"AllowAllDevices": true,
"Capabilities": [
"CAP_SYS_ADMIN",
"CAP_SYSLOG"
],
"Devices": [
{
"Description": "string",
"Name": "string",
"Path": "/dev/fuse",
"Settable": [
"string"
]
}
]
},
"Mounts": [
{
"Description": "This is a mount that's used by the plugin.",
"Destination": "/mnt/state",
"Name": "some-mount",
"Options": [
"rbind",
"rw"
],
"Settable": [
"string"
],
"Source": "/var/lib/docker/plugins/",
"Type": "bind"
}
],
"Network": {
"Type": "host"
},
"PidHost": true,
"PropagatedMount": "/mnt/volumes",
"User": {
"GID": 1000,
"UID": 1000
},
"WorkDir": "/bin/",
"rootfs": {
"diff_ids": [
"sha256:675532206fbf3030b8458f88d6e26d4eb1577688a25efec97154c94e8b6b4887",
"sha256:e216a057b1cb1efc11f8a268f37ef62083e70b1b38323ba252e25ac88904a7e8"
],
"type": "layers"
}
},
"Enabled": true,
"Id": "5724e2c8652da337ab2eedd19fc6fc0ec908e4bd907c7421bf6a8dfc70c4c078",
"Name": "tiborvass/sample-volume-plugin",
"PluginReference": "localhost:5000/tiborvass/sample-volume-plugin:latest",
"Settings": {
"Args": [
"string"
],
"Devices": [
{
"Description": "string",
"Name": "string",
"Path": "/dev/fuse",
"Settable": [
"string"
]
}
],
"Env": [
"DEBUG=0"
],
"Mounts": [
{
"Description": "This is a mount that's used by the plugin.",
"Destination": "/mnt/state",
"Name": "some-mount",
"Options": [
"rbind",
"rw"
],
"Settable": [
"string"
],
"Source": "/var/lib/docker/plugins/",
"Type": "bind"
}
]
}
}NOTE: This API endpoint does not work through the UCP API. Admins can use this API directly on each individual node's Docker daemon.
NOTE: This API endpoint does not work through the UCP API. Admins can use this API directly on each individual node's Docker daemon.
Push a plugin to the registry.
NOTE: This API endpoint does not work through the UCP API. Admins can use this API directly on each individual node's Docker daemon.
NOTE: This API endpoint does not work through the UCP API. Admins can use this API directly on each individual node's Docker daemon.
NOTE: This API endpoint does not work through the UCP API. Admins can use this API directly on each individual node's Docker daemon.
Base64-url-safe-encoded secret data
,User-defined key/value metadata.
,User-defined name of the secret.
[
{
"CreatedAt": "2016-11-05T01:20:17.327670065Z",
"ID": "ktnbjxoalbkvbvedmg1urrz8h",
"Spec": {
"Name": "app-dev.crt"
},
"UpdatedAt": "2016-11-05T01:20:17.327670065Z",
"Version": {
"Index": 11
}
}
]The ID of the created secret.
{
"ID": "ktnbjxoalbkvbvedmg1urrz8h"
}Base64-url-safe-encoded secret data
,User-defined key/value metadata.
,User-defined name of the secret.
{
"CreatedAt": "2016-11-05T01:20:17.327670065Z",
"ID": "ktnbjxoalbkvbvedmg1urrz8h",
"Spec": {
"Name": "app-dev.crt"
},
"UpdatedAt": "2016-11-05T01:20:17.327670065Z",
"Version": {
"Index": 11
}
}The status of a service update.
,User-defined key/value metadata.
,Scheduling mode for the service.
,Name of the service.
,Array of network names or IDs to attach the service to.
,Specification for the rollback strategy of the service.
,Specification for the update strategy of the service.
| string | |
|---|---|
| Enum: | "updating", "paused", "completed" |
| string | |
|---|---|
| Enum: | "tcp", "udp" |
The port on the swarm hosts.
,The port inside the container.
The mode of resolution to use for internal load balancing between tasks.
= ['vip', 'dnsrr']| string | |
|---|---|
| Default: | vip |
| Enum: | "vip", "dnsrr" |
List of exposed ports that this service is accessible on from the outside. Ports can only be provided if vip resolution mode is used.
Amount of time between rollback iterations, in nanoseconds.
,Action to take if an rolled back task fails to run, or stops running during the rollback.
= ['continue', 'pause']| string | |
|---|---|
| Enum: | "continue", "pause" |
The fraction of tasks that may fail during a rollback before the failure action is invoked, specified as a floating point number between 0 and 1.
| number | |
|---|---|
| Default: | 0 |
Amount of time to monitor each rolled back task for failures, in nanoseconds.
,The order of operations when rolling back a task. Either the old task is shut down before the new task is started, or the new task is started before the old task is shut down.
= ['stop-first', 'start-first']| string | |
|---|---|
| Enum: | "stop-first", "start-first" |
Maximum number of tasks to be rolled back in one iteration (0 means unlimited parallelism).
A counter that triggers an update even if no relevant parameters have been changed.
,Specifies the log driver to use for tasks created from this spec. If not present, the default one for the swarm will be used, finally falling back to the engine default if not specified.
,Resource requirements which apply to each individual container created as part of the service.
,Specification for the restart policy which applies to containers created as part of this service.
,Runtime is the type of runtime specified for the task executor.
Amount of time between updates, in nanoseconds.
,Action to take if an updated task fails to run, or stops running during the update.
= ['continue', 'pause', 'rollback']| string | |
|---|---|
| Enum: | "continue", "pause", "rollback" |
The fraction of tasks that may fail during an update before the failure action is invoked, specified as a floating point number between 0 and 1.
| number | |
|---|---|
| Default: | 0 |
Amount of time to monitor each updated task for failures, in nanoseconds.
,The order of operations when rolling out an updated task. Either the old task is shut down before the new task is started, or the new task is started before the old task is shut down.
= ['stop-first', 'start-first']| string | |
|---|---|
| Enum: | "stop-first", "start-first" |
Maximum number of tasks to be updated in one iteration (0 means unlimited parallelism).
Arguments to the command.
,The command to be run in the image.
,Configs contains references to zero or more configs that will be exposed to the service.
,Specification for DNS related configurations in resolver configuration file (resolv.conf).
The working directory for commands to run in.
,A list of environment variables in the form VAR=value.
A list of additional groups that the container process will run as.
,The hostname to use for the container, as a valid RFC 1123 hostname.
,A list of hostnames/IP mappings to add to the container's /etc/hosts file.
The format of extra hosts on swarmkit is specified in:
http://man7.org/linux/man-pages/man5/hosts.5.html
IP_address canonical_hostname [aliases...]
The image name to use for the container.
,User-defined key/value data.
,Specification for mounts to be added to containers created as part of the service.
,Open stdin
Security options for the container
,Mount the container's root filesystem as read only.
,Secrets contains references to zero or more secrets that will be exposed to the service.
,Amount of time to wait for the container to terminate before forcefully killing it.
,Signal to stop the container.
,Whether a pseudo-TTY should be allocated.
,The user inside the container.
An array of constraints.
,An array of supported platforms.
,Preferences provide a way to make the scheduler aware of factors such as topology. They are provided in order from highest to lowest precedence.
Define resources limits.
,Define resources reservation.
Condition for restart.
= ['none', 'on-failure', 'any']| string | |
|---|---|
| Enum: | "none", "on-failure", "any" |
Delay between restart attempts.
,Maximum attempts to restart a given container before giving up (default value is 0, which is ignored).
| integer | |
|---|---|
| Default: | 0 |
Windows is the time window used to evaluate the restart policy (default value is 0, which is unbounded).
| integer | |
|---|---|
| Default: | 0 |
ConfigID represents the ID of the specific config that we're referencing.
,ConfigName is the name of the config that this references, but this is just provided for lookup/display purposes. The config in the reference will be identified by its ID.
,File represents a specific target that is backed by a file.
The IP addresses of the name servers.
,A list of internal resolver variables to be modified (e.g., debug, ndots:3, etc.).
A search list for host-name lookup.
The time to wait between checks in nanoseconds. It should be 0 or at least 1000000 (1 ms). 0 means inherit.
,The number of consecutive failures needed to consider a container as unhealthy. 0 means inherit.
,Start period for the container to initialize before starting health-retries countdown in nanoseconds. It should be 0 or at least 1000000 (1 ms). 0 means inherit.
,The test to perform. Possible values are:
[] inherit healthcheck from image or parent image["NONE"] disable healthcheck["CMD", args...] exec arguments directly["CMD-SHELL", command] run command with system's default shellThe time to wait before considering the check to have hung. It should be 0 or at least 1000000 (1 ms). 0 means inherit.
Optional configuration for the bind type.
The consistency requirement for the mount: default, consistent, cached, or delegated.
Whether the mount should be read-only.
,Mount source (e.g. a volume name, a host path).
,Container path.
,Optional configuration for the tmpfs type.
The mount type. Available types:
bind Mounts a file or directory from the host into the container. Must exist prior to creating the container.volume Creates a volume with the given name and options (or uses a pre-existing volume with the same name and options). These are not removed when the container is removed.tmpfs Create a tmpfs with the given options. The mount source cannot be specified for tmpfs.| string | |
|---|---|
| Enum: | "bind", "volume", "tmpfs" |
Optional configuration for the volume type.
CredentialSpec for managed service account (Windows only)
,SELinux labels of the container
File represents a specific target that is backed by a file.
,SecretID represents the ID of the specific secret that we're referencing.
,SecretName is the name of the secret that this references, but this is just provided for lookup/display purposes. The secret in the reference will be identified by its ID.
Memory limit in Bytes.
,CPU limit in units of 10-9 CPU shares.
Memory reservation in Bytes.
,CPU reservation in units of 10-9 CPU shares.
GID represents the file GID.
,Mode represents the FileMode of the file.
,Name represents the final filename in the filesystem.
,UID represents the file UID.
A propagation mode with the value [r]private, [r]shared, or [r]slave.
| object | |
|---|---|
| Enum: | "private", "rprivate", "shared", "rshared", "slave", "rslave" |
The permission mode for the tmpfs mount in an integer.
,The size for the tmpfs mount in bytes.
Map of driver specific options
,User-defined key/value metadata.
,Populate volume with data from the target.
| boolean | |
|---|---|
| Default: | false |
Load credential spec from this file. The file is read by the daemon, and must be present in the
CredentialSpecs subdirectory in the docker data directory, which defaults to
C:\ProgramData\Docker\ on Windows.
For example, specifying spec.json loads C:\ProgramData\Docker\CredentialSpecs\spec.json.
> Note: CredentialSpec.File and CredentialSpec.Registry are mutually exclusive.
Load credential spec from this value in the Windows registry. The specified registry value must be located in:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Virtualization\Containers\CredentialSpecs
> Note: CredentialSpec.File and CredentialSpec.Registry are mutually exclusive.
Disable SELinux
,SELinux level label
,SELinux role label
,SELinux type label
,SELinux user label
GID represents the file GID.
,Mode represents the FileMode of the file.
,Name represents the final filename in the filesystem.
,UID represents the file UID.
label descriptor, such as engine.labels.az
Name of the driver to use to create the volume.
,key/value map of driver specific options.
[
{
"CreatedAt": "2016-06-07T21:05:51.880065305Z",
"Endpoint": {
"Ports": [
{
"Protocol": "tcp",
"PublishedPort": 30001,
"TargetPort": 6379
}
],
"Spec": {
"Mode": "vip",
"Ports": [
{
"Protocol": "tcp",
"PublishedPort": 30001,
"TargetPort": 6379
}
]
},
"VirtualIPs": [
{
"Addr": "10.255.0.2/16",
"NetworkID": "4qvuz4ko70xaltuqbt8956gd1"
},
{
"Addr": "10.255.0.3/16",
"NetworkID": "4qvuz4ko70xaltuqbt8956gd1"
}
]
},
"ID": "9mnpnzenvg8p8tdbtq4wvbkcz",
"Spec": {
"EndpointSpec": {
"Mode": "vip",
"Ports": [
{
"Protocol": "tcp",
"PublishedPort": 30001,
"TargetPort": 6379
}
]
},
"Mode": {
"Replicated": {
"Replicas": 1
}
},
"Name": "hopeful_cori",
"RollbackConfig": {
"Delay": 1000000000,
"FailureAction": "pause",
"MaxFailureRatio": 0.15,
"Monitor": 15000000000,
"Parallelism": 1
},
"TaskTemplate": {
"ContainerSpec": {
"Image": "redis"
},
"ForceUpdate": 0,
"Placement": {},
"Resources": {
"Limits": {},
"Reservations": {}
},
"RestartPolicy": {
"Condition": "any",
"MaxAttempts": 0
}
},
"UpdateConfig": {
"Delay": 1000000000,
"FailureAction": "pause",
"MaxFailureRatio": 0.15,
"Monitor": 15000000000,
"Parallelism": 1
}
},
"UpdatedAt": "2016-06-07T21:07:29.962229872Z",
"Version": {
"Index": 19
}
}
]The ID of the created service.
,Optional warning message
{
"ID": "ak7w3gjqoa3kuz8xcpnyy0pvl",
"Warning": "unable to pin image doesnotexist:latest to digest: image library/doesnotexist:latest not found"
}The status of a service update.
,User-defined key/value metadata.
,Scheduling mode for the service.
,Name of the service.
,Array of network names or IDs to attach the service to.
,Specification for the rollback strategy of the service.
,Specification for the update strategy of the service.
| string | |
|---|---|
| Enum: | "updating", "paused", "completed" |
| string | |
|---|---|
| Enum: | "tcp", "udp" |
The port on the swarm hosts.
,The port inside the container.
The mode of resolution to use for internal load balancing between tasks.
= ['vip', 'dnsrr']| string | |
|---|---|
| Default: | vip |
| Enum: | "vip", "dnsrr" |
List of exposed ports that this service is accessible on from the outside. Ports can only be provided if vip resolution mode is used.
Amount of time between rollback iterations, in nanoseconds.
,Action to take if an rolled back task fails to run, or stops running during the rollback.
= ['continue', 'pause']| string | |
|---|---|
| Enum: | "continue", "pause" |
The fraction of tasks that may fail during a rollback before the failure action is invoked, specified as a floating point number between 0 and 1.
| number | |
|---|---|
| Default: | 0 |
Amount of time to monitor each rolled back task for failures, in nanoseconds.
,The order of operations when rolling back a task. Either the old task is shut down before the new task is started, or the new task is started before the old task is shut down.
= ['stop-first', 'start-first']| string | |
|---|---|
| Enum: | "stop-first", "start-first" |
Maximum number of tasks to be rolled back in one iteration (0 means unlimited parallelism).
A counter that triggers an update even if no relevant parameters have been changed.
,Specifies the log driver to use for tasks created from this spec. If not present, the default one for the swarm will be used, finally falling back to the engine default if not specified.
,Resource requirements which apply to each individual container created as part of the service.
,Specification for the restart policy which applies to containers created as part of this service.
,Runtime is the type of runtime specified for the task executor.
Amount of time between updates, in nanoseconds.
,Action to take if an updated task fails to run, or stops running during the update.
= ['continue', 'pause', 'rollback']| string | |
|---|---|
| Enum: | "continue", "pause", "rollback" |
The fraction of tasks that may fail during an update before the failure action is invoked, specified as a floating point number between 0 and 1.
| number | |
|---|---|
| Default: | 0 |
Amount of time to monitor each updated task for failures, in nanoseconds.
,The order of operations when rolling out an updated task. Either the old task is shut down before the new task is started, or the new task is started before the old task is shut down.
= ['stop-first', 'start-first']| string | |
|---|---|
| Enum: | "stop-first", "start-first" |
Maximum number of tasks to be updated in one iteration (0 means unlimited parallelism).
Arguments to the command.
,The command to be run in the image.
,Configs contains references to zero or more configs that will be exposed to the service.
,Specification for DNS related configurations in resolver configuration file (resolv.conf).
The working directory for commands to run in.
,A list of environment variables in the form VAR=value.
A list of additional groups that the container process will run as.
,The hostname to use for the container, as a valid RFC 1123 hostname.
,A list of hostnames/IP mappings to add to the container's /etc/hosts file.
The format of extra hosts on swarmkit is specified in:
http://man7.org/linux/man-pages/man5/hosts.5.html
IP_address canonical_hostname [aliases...]
The image name to use for the container.
,User-defined key/value data.
,Specification for mounts to be added to containers created as part of the service.
,Open stdin
Security options for the container
,Mount the container's root filesystem as read only.
,Secrets contains references to zero or more secrets that will be exposed to the service.
,Amount of time to wait for the container to terminate before forcefully killing it.
,Signal to stop the container.
,Whether a pseudo-TTY should be allocated.
,The user inside the container.
An array of constraints.
,An array of supported platforms.
,Preferences provide a way to make the scheduler aware of factors such as topology. They are provided in order from highest to lowest precedence.
Define resources limits.
,Define resources reservation.
Condition for restart.
= ['none', 'on-failure', 'any']| string | |
|---|---|
| Enum: | "none", "on-failure", "any" |
Delay between restart attempts.
,Maximum attempts to restart a given container before giving up (default value is 0, which is ignored).
| integer | |
|---|---|
| Default: | 0 |
Windows is the time window used to evaluate the restart policy (default value is 0, which is unbounded).
| integer | |
|---|---|
| Default: | 0 |
ConfigID represents the ID of the specific config that we're referencing.
,ConfigName is the name of the config that this references, but this is just provided for lookup/display purposes. The config in the reference will be identified by its ID.
,File represents a specific target that is backed by a file.
The IP addresses of the name servers.
,A list of internal resolver variables to be modified (e.g., debug, ndots:3, etc.).
A search list for host-name lookup.
The time to wait between checks in nanoseconds. It should be 0 or at least 1000000 (1 ms). 0 means inherit.
,The number of consecutive failures needed to consider a container as unhealthy. 0 means inherit.
,Start period for the container to initialize before starting health-retries countdown in nanoseconds. It should be 0 or at least 1000000 (1 ms). 0 means inherit.
,The test to perform. Possible values are:
[] inherit healthcheck from image or parent image["NONE"] disable healthcheck["CMD", args...] exec arguments directly["CMD-SHELL", command] run command with system's default shellThe time to wait before considering the check to have hung. It should be 0 or at least 1000000 (1 ms). 0 means inherit.
Optional configuration for the bind type.
The consistency requirement for the mount: default, consistent, cached, or delegated.
Whether the mount should be read-only.
,Mount source (e.g. a volume name, a host path).
,Container path.
,Optional configuration for the tmpfs type.
The mount type. Available types:
bind Mounts a file or directory from the host into the container. Must exist prior to creating the container.volume Creates a volume with the given name and options (or uses a pre-existing volume with the same name and options). These are not removed when the container is removed.tmpfs Create a tmpfs with the given options. The mount source cannot be specified for tmpfs.| string | |
|---|---|
| Enum: | "bind", "volume", "tmpfs" |
Optional configuration for the volume type.
CredentialSpec for managed service account (Windows only)
,SELinux labels of the container
File represents a specific target that is backed by a file.
,SecretID represents the ID of the specific secret that we're referencing.
,SecretName is the name of the secret that this references, but this is just provided for lookup/display purposes. The secret in the reference will be identified by its ID.
Memory limit in Bytes.
,CPU limit in units of 10-9 CPU shares.
Memory reservation in Bytes.
,CPU reservation in units of 10-9 CPU shares.
GID represents the file GID.
,Mode represents the FileMode of the file.
,Name represents the final filename in the filesystem.
,UID represents the file UID.
A propagation mode with the value [r]private, [r]shared, or [r]slave.
| object | |
|---|---|
| Enum: | "private", "rprivate", "shared", "rshared", "slave", "rslave" |
The permission mode for the tmpfs mount in an integer.
,The size for the tmpfs mount in bytes.
Map of driver specific options
,User-defined key/value metadata.
,Populate volume with data from the target.
| boolean | |
|---|---|
| Default: | false |
Load credential spec from this file. The file is read by the daemon, and must be present in the
CredentialSpecs subdirectory in the docker data directory, which defaults to
C:\ProgramData\Docker\ on Windows.
For example, specifying spec.json loads C:\ProgramData\Docker\CredentialSpecs\spec.json.
> Note: CredentialSpec.File and CredentialSpec.Registry are mutually exclusive.
Load credential spec from this value in the Windows registry. The specified registry value must be located in:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Virtualization\Containers\CredentialSpecs
> Note: CredentialSpec.File and CredentialSpec.Registry are mutually exclusive.
Disable SELinux
,SELinux level label
,SELinux role label
,SELinux type label
,SELinux user label
GID represents the file GID.
,Mode represents the FileMode of the file.
,Name represents the final filename in the filesystem.
,UID represents the file UID.
label descriptor, such as engine.labels.az
Name of the driver to use to create the volume.
,key/value map of driver specific options.
{
"CreatedAt": "2016-06-07T21:05:51.880065305Z",
"Endpoint": {
"Ports": [
{
"Protocol": "tcp",
"PublishedPort": 30001,
"TargetPort": 6379
}
],
"Spec": {
"Mode": "vip",
"Ports": [
{
"Protocol": "tcp",
"PublishedPort": 30001,
"TargetPort": 6379
}
]
},
"VirtualIPs": [
{
"Addr": "10.255.0.2/16",
"NetworkID": "4qvuz4ko70xaltuqbt8956gd1"
},
{
"Addr": "10.255.0.3/16",
"NetworkID": "4qvuz4ko70xaltuqbt8956gd1"
}
]
},
"ID": "9mnpnzenvg8p8tdbtq4wvbkcz",
"Spec": {
"EndpointSpec": {
"Mode": "vip",
"Ports": [
{
"Protocol": "tcp",
"PublishedPort": 30001,
"TargetPort": 6379
}
]
},
"Mode": {
"Replicated": {
"Replicas": 1
}
},
"Name": "hopeful_cori",
"RollbackConfig": {
"Delay": 1000000000,
"FailureAction": "pause",
"MaxFailureRatio": 0.15,
"Monitor": 15000000000,
"Parallelism": 1
},
"TaskTemplate": {
"ContainerSpec": {
"Image": "redis"
},
"ForceUpdate": 0,
"Placement": {},
"Resources": {
"Limits": {},
"Reservations": {}
},
"RestartPolicy": {
"Condition": "any",
"MaxAttempts": 0
}
},
"UpdateConfig": {
"Delay": 1000000000,
"FailureAction": "pause",
"MaxFailureRatio": 0.15,
"Monitor": 15000000000,
"Parallelism": 1
}
},
"UpdatedAt": "2016-06-07T21:07:29.962229872Z",
"Version": {
"Index": 19
}
}Get stdout and stderr logs from a service.
Note: This endpoint works only for services with the json-file or journald logging drivers.
Optional warning messages
{
"Warning": "unable to pin image doesnotexist:latest to digest: image library/doesnotexist:latest not found"
}{
"CreatedAt": "2016-08-15T16:00:20.349727406Z",
"ID": "70ilmkj2f6sp2137c753w2nmt",
"JoinTokens": {
"Manager": "SWMTKN-1-1h8aps2yszaiqmz2l3oc5392pgk8e49qhx2aj3nyv0ui0hez2a-8llk83c4wm9lwioey2s316r9l",
"Worker": "SWMTKN-1-1h8aps2yszaiqmz2l3oc5392pgk8e49qhx2aj3nyv0ui0hez2a-6qmn92w6bu3jdvnglku58u11a"
},
"RootRotationInProgress": false,
"Spec": {
"CAConfig": {
"NodeCertExpiry": 7776000000000000
},
"Dispatcher": {
"HeartbeatPeriod": 5000000000
},
"EncryptionConfig": {
"AutoLockManagers": false
},
"Name": "default",
"Orchestration": {
"TaskHistoryRetentionLimit": 10
},
"Raft": {
"ElectionTick": 3,
"HeartbeatTick": 1,
"LogEntriesForSlowFollowers": 500,
"SnapshotInterval": 10000
},
"TaskDefaults": {}
},
"TLSInfo": {
"CertIssuerPublicKey": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEmT9XIw9h1qoNclv9VeHmf/Vi6/uI2vFXdBveXTpcPjqx6i9wNazchk1XWV/dKTKvSh9xyGKmiIeRcE4OiMnJ1A==",
"CertIssuerSubject": "MBMxETAPBgNVBAMTCHN3YXJtLWNh",
"TrustRoot": "-----BEGIN CERTIFICATE-----\nMIIBajCCARCgAwIBAgIUbYqrLSOSQHoxD8CwG6Bi2PJi9c8wCgYIKoZIzj0EAwIw\nEzERMA8GA1UEAxMIc3dhcm0tY2EwHhcNMTcwNDI0MjE0MzAwWhcNMzcwNDE5MjE0\nMzAwWjATMREwDwYDVQQDEwhzd2FybS1jYTBZMBMGByqGSM49AgEGCCqGSM49AwEH\nA0IABJk/VyMPYdaqDXJb/VXh5n/1Yuv7iNrxV3Qb3l06XD46seovcDWs3IZNV1lf\n3Skyr0ofcchipoiHkXBODojJydSjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMB\nAf8EBTADAQH/MB0GA1UdDgQWBBRUXxuRcnFjDfR/RIAUQab8ZV/n4jAKBggqhkjO\nPQQDAgNIADBFAiAy+JTe6Uc3KyLCMiqGl2GyWGQqQDEcO3/YG36x7om65AIhAJvz\npxv6zFeVEkAEEkqIYi0omA9+CjanB/6Bz4n1uw8H\n-----END CERTIFICATE-----\n"
},
"UpdatedAt": "2016-08-15T16:32:09.623207604Z",
"Version": {
"Index": 51
}
}
Validate credentials for a registry and, if available, get an identity token for accessing the registry without password.
An opaque token used to authenticate a user after a successful login
,The status of the authentication
{
"IdentityToken": "9cbaf023786cd7...",
"Status": "Login Succeeded"
}Stream real-time events from the server.
Various objects within Docker report events when something happens to them.
Containers report these events: attach, commit, copy, create, destroy, detach, die, exec_create, exec_detach, exec_start, export, health_status, kill, oom, pause, rename, resize, restart, start, stop, top, unpause, and update
Images report these events: delete, import, load, pull, push, save, tag, and untag
Volumes report these events: create, mount, unmount, and destroy
Networks report these events: create, connect, disconnect, destroy, update, and remove
The Docker daemon reports these events: reload
Services report these events: create, update, and remove
Nodes report these events: create, update, and remove
Secrets report these events: create, update, and remove
The type of event
,The type of object emitting the event
,Timestamp of event
,Timestamp of event, with nanosecond accuracy
Various key/value attributes of the object, depending on its type
,The ID of the object emitting the event
{
"Action": "create",
"Actor": {
"Attributes": {
"com.example.some-label": "some-label-value",
"image": "alpine",
"name": "my-container"
},
"ID": "ede54ee1afda366ab42f824e8a5ffd195155d853ceaec74a927f249ea270c743"
},
"Type": "container",
"time": 1461943101
}UCP returns a combination of info about the swarm, including:
Swarm manager status
Swarm scheduler strategy
Swarm-manager endpoints that are useful for administrator access when troubleshooting
Engine proxy endpoints for each node in the swarm that are useful for troubleshooting
Plugins present on the current manager node
Engine information for the current manager node
{
"Architecture": "x86_64",
"CgroupDriver": "cgroupfs",
"ClusterStore": "etcd://localhost:2379",
"Containers": 11,
"ContainersPaused": 1,
"ContainersRunning": 7,
"ContainersStopped": 3,
"CpuCfsPeriod": true,
"CpuCfsQuota": true,
"Debug": false,
"DockerRootDir": "/var/lib/docker",
"Driver": "btrfs",
"DriverStatus": [
[
""
]
],
"ExperimentalBuild": false,
"HttpProxy": "http://test:test@localhost:8080",
"HttpsProxy": "https://test:test@localhost:8080",
"ID": "7TRN:IPZB:QYBB:VPBQ:UMPP:KARE:6ZNR:XE6T:7EWV:PKF4:ZOJD:TPYS",
"IPv4Forwarding": true,
"Images": 16,
"IndexServerAddress": "https://index.docker.io/v1/",
"InitPath": "/usr/bin/docker",
"InitSha1": "",
"KernelMemory": true,
"KernelVersion": "3.12.0-1-amd64",
"Labels": [
"storage=ssd"
],
"MemTotal": 2099236864,
"MemoryLimit": true,
"NCPU": 1,
"NEventsListener": 0,
"NFd": 11,
"NGoroutines": 21,
"Name": "prod-server-42",
"NoProxy": "9.81.1.160",
"OSType": "linux",
"OomKillDisable": true,
"OperatingSystem": "Boot2Docker",
"Plugins": {
"Network": [
"null",
"host",
"bridge"
],
"Volume": [
"local"
]
},
"RegistryConfig": {
"IndexConfigs": {
"docker.io": {
"Name": "docker.io",
"Official": true,
"Secure": true
}
},
"InsecureRegistryCIDRs": [
"127.0.0.0/8"
]
},
"SecurityOptions": [
{
"Key": "Name",
"Value": "seccomp"
},
{
"Key": "Profile",
"Value": "default"
},
{
"Key": "Name",
"Value": "apparmor"
},
{
"Key": "Name",
"Value": "selinux"
},
{
"Key": "Name",
"Value": "userns"
}
],
"ServerVersion": "1.9.0",
"SwapLimit": false,
"SystemStatus": [
[
"State",
"Healthy"
]
],
"SystemTime": "2015-03-10T11:11:23.730591467-07:00"
}Returns the version of Docker that is running and various information about the system that Docker is running on.
{
"ApiVersion": "1.27",
"Arch": "amd64",
"BuildTime": "2016-06-14T07:09:13.444803460+00:00",
"Experimental": true,
"GitCommit": "deadbee",
"GoVersion": "go1.7.5",
"KernelVersion": "3.19.0-23-generic",
"MinAPIVersion": "1.12",
"Os": "linux",
"Version": "17.04.0"
}| string | |
|---|---|
| Enum: | "new", "allocated", "pending", "assigned", "accepted", "preparing", "ready", "starting", "running", "complete", "shutdown", "failed", "rejected" |
The ID of the task.
,User-defined key/value metadata.
,Name of the task.
,The ID of the node that this task is on.
,The ID of the service this task is part of.
,A counter that triggers an update even if no relevant parameters have been changed.
,Specifies the log driver to use for tasks created from this spec. If not present, the default one for the swarm will be used, finally falling back to the engine default if not specified.
,Resource requirements which apply to each individual container created as part of the service.
,Specification for the restart policy which applies to containers created as part of this service.
,Runtime is the type of runtime specified for the task executor.
| string | |
|---|---|
| Enum: | "new", "allocated", "pending", "assigned", "accepted", "preparing", "ready", "starting", "running", "complete", "shutdown", "failed", "rejected" |
Arguments to the command.
,The command to be run in the image.
,Configs contains references to zero or more configs that will be exposed to the service.
,Specification for DNS related configurations in resolver configuration file (resolv.conf).
The working directory for commands to run in.
,A list of environment variables in the form VAR=value.
A list of additional groups that the container process will run as.
,The hostname to use for the container, as a valid RFC 1123 hostname.
,A list of hostnames/IP mappings to add to the container's /etc/hosts file.
The format of extra hosts on swarmkit is specified in:
http://man7.org/linux/man-pages/man5/hosts.5.html
IP_address canonical_hostname [aliases...]
The image name to use for the container.
,User-defined key/value data.
,Specification for mounts to be added to containers created as part of the service.
,Open stdin
Security options for the container
,Mount the container's root filesystem as read only.
,Secrets contains references to zero or more secrets that will be exposed to the service.
,Amount of time to wait for the container to terminate before forcefully killing it.
,Signal to stop the container.
,Whether a pseudo-TTY should be allocated.
,The user inside the container.
An array of constraints.
,An array of supported platforms.
,Preferences provide a way to make the scheduler aware of factors such as topology. They are provided in order from highest to lowest precedence.
Define resources limits.
,Define resources reservation.
Condition for restart.
= ['none', 'on-failure', 'any']| string | |
|---|---|
| Enum: | "none", "on-failure", "any" |
Delay between restart attempts.
,Maximum attempts to restart a given container before giving up (default value is 0, which is ignored).
| integer | |
|---|---|
| Default: | 0 |
Windows is the time window used to evaluate the restart policy (default value is 0, which is unbounded).
| integer | |
|---|---|
| Default: | 0 |
ConfigID represents the ID of the specific config that we're referencing.
,ConfigName is the name of the config that this references, but this is just provided for lookup/display purposes. The config in the reference will be identified by its ID.
,File represents a specific target that is backed by a file.
The IP addresses of the name servers.
,A list of internal resolver variables to be modified (e.g., debug, ndots:3, etc.).
A search list for host-name lookup.
The time to wait between checks in nanoseconds. It should be 0 or at least 1000000 (1 ms). 0 means inherit.
,The number of consecutive failures needed to consider a container as unhealthy. 0 means inherit.
,Start period for the container to initialize before starting health-retries countdown in nanoseconds. It should be 0 or at least 1000000 (1 ms). 0 means inherit.
,The test to perform. Possible values are:
[] inherit healthcheck from image or parent image["NONE"] disable healthcheck["CMD", args...] exec arguments directly["CMD-SHELL", command] run command with system's default shellThe time to wait before considering the check to have hung. It should be 0 or at least 1000000 (1 ms). 0 means inherit.
Optional configuration for the bind type.
The consistency requirement for the mount: default, consistent, cached, or delegated.
Whether the mount should be read-only.
,Mount source (e.g. a volume name, a host path).
,Container path.
,Optional configuration for the tmpfs type.
The mount type. Available types:
bind Mounts a file or directory from the host into the container. Must exist prior to creating the container.volume Creates a volume with the given name and options (or uses a pre-existing volume with the same name and options). These are not removed when the container is removed.tmpfs Create a tmpfs with the given options. The mount source cannot be specified for tmpfs.| string | |
|---|---|
| Enum: | "bind", "volume", "tmpfs" |
Optional configuration for the volume type.
CredentialSpec for managed service account (Windows only)
,SELinux labels of the container
File represents a specific target that is backed by a file.
,SecretID represents the ID of the specific secret that we're referencing.
,SecretName is the name of the secret that this references, but this is just provided for lookup/display purposes. The secret in the reference will be identified by its ID.
Memory limit in Bytes.
,CPU limit in units of 10-9 CPU shares.
Memory reservation in Bytes.
,CPU reservation in units of 10-9 CPU shares.
GID represents the file GID.
,Mode represents the FileMode of the file.
,Name represents the final filename in the filesystem.
,UID represents the file UID.
A propagation mode with the value [r]private, [r]shared, or [r]slave.
| object | |
|---|---|
| Enum: | "private", "rprivate", "shared", "rshared", "slave", "rslave" |
The permission mode for the tmpfs mount in an integer.
,The size for the tmpfs mount in bytes.
Map of driver specific options
,User-defined key/value metadata.
,Populate volume with data from the target.
| boolean | |
|---|---|
| Default: | false |
Load credential spec from this file. The file is read by the daemon, and must be present in the
CredentialSpecs subdirectory in the docker data directory, which defaults to
C:\ProgramData\Docker\ on Windows.
For example, specifying spec.json loads C:\ProgramData\Docker\CredentialSpecs\spec.json.
> Note: CredentialSpec.File and CredentialSpec.Registry are mutually exclusive.
Load credential spec from this value in the Windows registry. The specified registry value must be located in:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Virtualization\Containers\CredentialSpecs
> Note: CredentialSpec.File and CredentialSpec.Registry are mutually exclusive.
Disable SELinux
,SELinux level label
,SELinux role label
,SELinux type label
,SELinux user label
GID represents the file GID.
,Mode represents the FileMode of the file.
,Name represents the final filename in the filesystem.
,UID represents the file UID.
label descriptor, such as engine.labels.az
Name of the driver to use to create the volume.
,key/value map of driver specific options.
[
{
"CreatedAt": "2016-06-07T21:07:31.171892745Z",
"DesiredState": "running",
"ID": "0kzzo1i0y4jz6027t0k7aezc7",
"NetworksAttachments": [
{
"Addresses": [
"10.255.0.10/16"
],
"Network": {
"CreatedAt": "2016-06-07T20:31:11.912919752Z",
"DriverState": {
"Name": "overlay",
"Options": {
"com.docker.network.driver.overlay.vxlanid_list": "256"
}
},
"ID": "4qvuz4ko70xaltuqbt8956gd1",
"IPAMOptions": {
"Configs": [
{
"Gateway": "10.255.0.1",
"Subnet": "10.255.0.0/16"
}
],
"Driver": {
"Name": "default"
}
},
"Spec": {
"DriverConfiguration": {},
"IPAMOptions": {
"Configs": [
{
"Gateway": "10.255.0.1",
"Subnet": "10.255.0.0/16"
}
],
"Driver": {}
},
"Labels": {
"com.docker.swarm.internal": "true"
},
"Name": "ingress"
},
"UpdatedAt": "2016-06-07T21:07:29.955277358Z",
"Version": {
"Index": 18
}
}
}
],
"NodeID": "60gvrl6tm78dmak4yl7srz94v",
"ServiceID": "9mnpnzenvg8p8tdbtq4wvbkcz",
"Slot": 1,
"Spec": {
"ContainerSpec": {
"Image": "redis"
},
"Placement": {},
"Resources": {
"Limits": {},
"Reservations": {}
},
"RestartPolicy": {
"Condition": "any",
"MaxAttempts": 0
}
},
"Status": {
"ContainerStatus": {
"ContainerID": "e5d62702a1b48d01c3e02ca1e0212a250801fa8d67caca0b6f35919ebc12f035",
"PID": 677
},
"Message": "started",
"State": "running",
"Timestamp": "2016-06-07T21:07:31.290032978Z"
},
"UpdatedAt": "2016-06-07T21:07:31.376370513Z",
"Version": {
"Index": 71
}
},
{
"CreatedAt": "2016-06-07T21:07:30.019104782Z",
"DesiredState": "shutdown",
"ID": "1yljwbmlr8er2waf8orvqpwms",
"Name": "hopeful_cori",
"NetworksAttachments": [
{
"Addresses": [
"10.255.0.5/16"
],
"Network": {
"CreatedAt": "2016-06-07T20:31:11.912919752Z",
"DriverState": {
"Name": "overlay",
"Options": {
"com.docker.network.driver.overlay.vxlanid_list": "256"
}
},
"ID": "4qvuz4ko70xaltuqbt8956gd1",
"IPAMOptions": {
"Configs": [
{
"Gateway": "10.255.0.1",
"Subnet": "10.255.0.0/16"
}
],
"Driver": {
"Name": "default"
}
},
"Spec": {
"DriverConfiguration": {},
"IPAMOptions": {
"Configs": [
{
"Gateway": "10.255.0.1",
"Subnet": "10.255.0.0/16"
}
],
"Driver": {}
},
"Labels": {
"com.docker.swarm.internal": "true"
},
"Name": "ingress"
},
"UpdatedAt": "2016-06-07T21:07:29.955277358Z",
"Version": {
"Index": 18
}
}
}
],
"NodeID": "60gvrl6tm78dmak4yl7srz94v",
"ServiceID": "9mnpnzenvg8p8tdbtq4wvbkcz",
"Slot": 1,
"Spec": {
"ContainerSpec": {
"Image": "redis"
},
"Placement": {},
"Resources": {
"Limits": {},
"Reservations": {}
},
"RestartPolicy": {
"Condition": "any",
"MaxAttempts": 0
}
},
"Status": {
"ContainerStatus": {
"ContainerID": "1cf8d63d18e79668b0004a4be4c6ee58cddfad2dae29506d8781581d0688a213"
},
"Message": "shutdown",
"State": "shutdown",
"Timestamp": "2016-06-07T21:07:30.202183143Z"
},
"UpdatedAt": "2016-06-07T21:07:30.231958098Z",
"Version": {
"Index": 30
}
}
]| string | |
|---|---|
| Enum: | "new", "allocated", "pending", "assigned", "accepted", "preparing", "ready", "starting", "running", "complete", "shutdown", "failed", "rejected" |
The ID of the task.
,User-defined key/value metadata.
,Name of the task.
,The ID of the node that this task is on.
,The ID of the service this task is part of.
,A counter that triggers an update even if no relevant parameters have been changed.
,Specifies the log driver to use for tasks created from this spec. If not present, the default one for the swarm will be used, finally falling back to the engine default if not specified.
,Resource requirements which apply to each individual container created as part of the service.
,Specification for the restart policy which applies to containers created as part of this service.
,Runtime is the type of runtime specified for the task executor.
| string | |
|---|---|
| Enum: | "new", "allocated", "pending", "assigned", "accepted", "preparing", "ready", "starting", "running", "complete", "shutdown", "failed", "rejected" |
Arguments to the command.
,The command to be run in the image.
,Configs contains references to zero or more configs that will be exposed to the service.
,Specification for DNS related configurations in resolver configuration file (resolv.conf).
The working directory for commands to run in.
,A list of environment variables in the form VAR=value.
A list of additional groups that the container process will run as.
,The hostname to use for the container, as a valid RFC 1123 hostname.
,A list of hostnames/IP mappings to add to the container's /etc/hosts file.
The format of extra hosts on swarmkit is specified in:
http://man7.org/linux/man-pages/man5/hosts.5.html
IP_address canonical_hostname [aliases...]
The image name to use for the container.
,User-defined key/value data.
,Specification for mounts to be added to containers created as part of the service.
,Open stdin
Security options for the container
,Mount the container's root filesystem as read only.
,Secrets contains references to zero or more secrets that will be exposed to the service.
,Amount of time to wait for the container to terminate before forcefully killing it.
,Signal to stop the container.
,Whether a pseudo-TTY should be allocated.
,The user inside the container.
An array of constraints.
,An array of supported platforms.
,Preferences provide a way to make the scheduler aware of factors such as topology. They are provided in order from highest to lowest precedence.
Define resources limits.
,Define resources reservation.
Condition for restart.
= ['none', 'on-failure', 'any']| string | |
|---|---|
| Enum: | "none", "on-failure", "any" |
Delay between restart attempts.
,Maximum attempts to restart a given container before giving up (default value is 0, which is ignored).
| integer | |
|---|---|
| Default: | 0 |
Windows is the time window used to evaluate the restart policy (default value is 0, which is unbounded).
| integer | |
|---|---|
| Default: | 0 |
ConfigID represents the ID of the specific config that we're referencing.
,ConfigName is the name of the config that this references, but this is just provided for lookup/display purposes. The config in the reference will be identified by its ID.
,File represents a specific target that is backed by a file.
The IP addresses of the name servers.
,A list of internal resolver variables to be modified (e.g., debug, ndots:3, etc.).
A search list for host-name lookup.
The time to wait between checks in nanoseconds. It should be 0 or at least 1000000 (1 ms). 0 means inherit.
,The number of consecutive failures needed to consider a container as unhealthy. 0 means inherit.
,Start period for the container to initialize before starting health-retries countdown in nanoseconds. It should be 0 or at least 1000000 (1 ms). 0 means inherit.
,The test to perform. Possible values are:
[] inherit healthcheck from image or parent image["NONE"] disable healthcheck["CMD", args...] exec arguments directly["CMD-SHELL", command] run command with system's default shellThe time to wait before considering the check to have hung. It should be 0 or at least 1000000 (1 ms). 0 means inherit.
Optional configuration for the bind type.
The consistency requirement for the mount: default, consistent, cached, or delegated.
Whether the mount should be read-only.
,Mount source (e.g. a volume name, a host path).
,Container path.
,Optional configuration for the tmpfs type.
The mount type. Available types:
bind Mounts a file or directory from the host into the container. Must exist prior to creating the container.volume Creates a volume with the given name and options (or uses a pre-existing volume with the same name and options). These are not removed when the container is removed.tmpfs Create a tmpfs with the given options. The mount source cannot be specified for tmpfs.| string | |
|---|---|
| Enum: | "bind", "volume", "tmpfs" |
Optional configuration for the volume type.
CredentialSpec for managed service account (Windows only)
,SELinux labels of the container
File represents a specific target that is backed by a file.
,SecretID represents the ID of the specific secret that we're referencing.
,SecretName is the name of the secret that this references, but this is just provided for lookup/display purposes. The secret in the reference will be identified by its ID.
Memory limit in Bytes.
,CPU limit in units of 10-9 CPU shares.
Memory reservation in Bytes.
,CPU reservation in units of 10-9 CPU shares.
GID represents the file GID.
,Mode represents the FileMode of the file.
,Name represents the final filename in the filesystem.
,UID represents the file UID.
A propagation mode with the value [r]private, [r]shared, or [r]slave.
| object | |
|---|---|
| Enum: | "private", "rprivate", "shared", "rshared", "slave", "rslave" |
The permission mode for the tmpfs mount in an integer.
,The size for the tmpfs mount in bytes.
Map of driver specific options
,User-defined key/value metadata.
,Populate volume with data from the target.
| boolean | |
|---|---|
| Default: | false |
Load credential spec from this file. The file is read by the daemon, and must be present in the
CredentialSpecs subdirectory in the docker data directory, which defaults to
C:\ProgramData\Docker\ on Windows.
For example, specifying spec.json loads C:\ProgramData\Docker\CredentialSpecs\spec.json.
> Note: CredentialSpec.File and CredentialSpec.Registry are mutually exclusive.
Load credential spec from this value in the Windows registry. The specified registry value must be located in:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Virtualization\Containers\CredentialSpecs
> Note: CredentialSpec.File and CredentialSpec.Registry are mutually exclusive.
Disable SELinux
,SELinux level label
,SELinux role label
,SELinux type label
,SELinux user label
GID represents the file GID.
,Mode represents the FileMode of the file.
,Name represents the final filename in the filesystem.
,UID represents the file UID.
label descriptor, such as engine.labels.az
Name of the driver to use to create the volume.
,key/value map of driver specific options.
{
"CreatedAt": "2016-06-07T21:07:31.171892745Z",
"DesiredState": "running",
"ID": "0kzzo1i0y4jz6027t0k7aezc7",
"NetworksAttachments": [
{
"Addresses": [
"10.255.0.10/16"
],
"Network": {
"CreatedAt": "2016-06-07T20:31:11.912919752Z",
"DriverState": {
"Name": "overlay",
"Options": {
"com.docker.network.driver.overlay.vxlanid_list": "256"
}
},
"ID": "4qvuz4ko70xaltuqbt8956gd1",
"IPAMOptions": {
"Configs": [
{
"Gateway": "10.255.0.1",
"Subnet": "10.255.0.0/16"
}
],
"Driver": {
"Name": "default"
}
},
"Spec": {
"DriverConfiguration": {},
"IPAMOptions": {
"Configs": [
{
"Gateway": "10.255.0.1",
"Subnet": "10.255.0.0/16"
}
],
"Driver": {}
},
"Labels": {
"com.docker.swarm.internal": "true"
},
"Name": "ingress"
},
"UpdatedAt": "2016-06-07T21:07:29.955277358Z",
"Version": {
"Index": 18
}
}
}
],
"NodeID": "60gvrl6tm78dmak4yl7srz94v",
"ServiceID": "9mnpnzenvg8p8tdbtq4wvbkcz",
"Slot": 1,
"Spec": {
"ContainerSpec": {
"Image": "redis"
},
"Placement": {},
"Resources": {
"Limits": {},
"Reservations": {}
},
"RestartPolicy": {
"Condition": "any",
"MaxAttempts": 0
}
},
"Status": {
"ContainerStatus": {
"ContainerID": "e5d62702a1b48d01c3e02ca1e0212a250801fa8d67caca0b6f35919ebc12f035",
"PID": 677
},
"Message": "started",
"State": "running",
"Timestamp": "2016-06-07T21:07:31.290032978Z"
},
"UpdatedAt": "2016-06-07T21:07:31.376370513Z",
"Version": {
"Index": 71
}
}Get options for syncing members of a team. Requires authentication and authorization as an admin user, an admin member of the organization, or an admin member of the team.
Whether to enable LDAP syncing. If false, all other fields are ignored
,The distinguished name of the LDAP group. Applicable only if selectGroupMembers is true, ignored otherwise
,The name of the LDAP group entry attribute which corresponds to distinguished names of members. Applicable only if selectGroupMembers is true, ignored otherwise
,The distinguished name of the element from which the LDAP server will search for users. Applicable only if selectGroupMembers is false, ignored otherwise
,The LDAP search filter used to select users if selectGroupMembers is false, may be left blank
,Whether to search for users in the entire subtree of the base DN or to only search one level under the base DN (if false). Applicable only if selectGroupMembers is false, ignored otherwise
,Whether to sync using a group DN and member attribute selection or to use a search filter (if false)
{
"enableSync": true,
"groupDN": "string",
"groupMemberAttr": "string",
"searchBaseDN": "string",
"searchFilter": "string",
"searchScopeSubtree": true,
"selectGroupMembers": true
}Set options for syncing members of a team. Enabling sync of team members will disable the ability to manually manage team membership for any users imported from LDAP. Their team membership is instead managed by the LDAP sync. Requires authentication and authorization as an admin user, an admin member of the organization, or an admin member of the team.
Whether to enable LDAP syncing. If false, all other fields are ignored
,The distinguished name of the LDAP group. Applicable only if selectGroupMembers is true, ignored otherwise
,The name of the LDAP group entry attribute which corresponds to distinguished names of members. Applicable only if selectGroupMembers is true, ignored otherwise
,The distinguished name of the element from which the LDAP server will search for users. Applicable only if selectGroupMembers is false, ignored otherwise
,The LDAP search filter used to select users if selectGroupMembers is false, may be left blank
,Whether to search for users in the entire subtree of the base DN or to only search one level under the base DN (if false). Applicable only if selectGroupMembers is false, ignored otherwise
,Whether to sync using a group DN and member attribute selection or to use a search filter (if false)
{
"enableSync": true,
"groupDN": "string",
"groupMemberAttr": "string",
"searchBaseDN": "string",
"searchFilter": "string",
"searchScopeSubtree": true,
"selectGroupMembers": true
}List members of a team. Lists memberships in ascending order by user ID. Requires authentication and authorization as an admin user or a member of the organization.
Whether the member is an admin of the organization or team
,The user which is a member of the organization or team
Full Name of the account
,ID of the account
,Whether the user is active and can login (users only)
,Whether the user is a system admin (users only)
,Whether the user was imported from an upstream identity provider
,Whether the account is an organization (or user)
,The number of members of the organization
,Name of the account
{
"members": [
{
"isAdmin": true,
"member": {
"fullName": "string",
"id": "string",
"isActive": true,
"isAdmin": true,
"isImported": true,
"isOrg": true,
"membersCount": 0,
"name": "string"
}
}
]
}Remove a member from a team. The user will remain a member of the organization. If team members are configured to be synced with LDAP, users which are imported from LDAP cannot be manually removed as members of the team and must be synced with LDAP. Requires authentication and authorization as an admin user, an admin member of the organization, or an admin member of the team.
Details of a user's membership in a team. Requires authentication and authorization as an admin user or a member of the organization.
Whether the member is an admin of the organization or team
,The user which is a member of the organization or team
Full Name of the account
,ID of the account
,Whether the user is active and can login (users only)
,Whether the user is a system admin (users only)
,Whether the user was imported from an upstream identity provider
,Whether the account is an organization (or user)
,The number of members of the organization
,Name of the account
{
"isAdmin": true,
"member": {
"fullName": "string",
"id": "string",
"isActive": true,
"isAdmin": true,
"isImported": true,
"isOrg": true,
"membersCount": 0,
"name": "string"
}
}Add a user to a team. The user will be added as a member of the organization if they are not already. If team members are configured to be synced with LDAP, users which are imported from LDAP cannot be manually added as members of the team and must be synced with LDAP. Requires authentication and authorization as an admin user, an admin member of the organization, or an admin member of the team.
Whether the member is an admin of the organization or team
,The user which is a member of the organization or team
Full Name of the account
,ID of the account
,Whether the user is active and can login (users only)
,Whether the user is a system admin (users only)
,Whether the user was imported from an upstream identity provider
,Whether the account is an organization (or user)
,The number of members of the organization
,Name of the account
{
"isAdmin": true,
"member": {
"fullName": "string",
"id": "string",
"isActive": true,
"isAdmin": true,
"isImported": true,
"isOrg": true,
"membersCount": 0,
"name": "string"
}
}List teams in an organization. Lists teams in ascending order by name. Requires authentication and authorization as an admin user or a member of the organization.
Description of the team
,ID of the team
,The number of members of the team
,Name of the team
,ID of the organization to which this team belongs
{
"teams": [
{
"description": "string",
"id": "string",
"membersCount": 0,
"name": "string",
"orgID": "string"
}
]
}Create a team. Requires authentication and authorization as an admin user or an admin member of the organization.
Description of the team
,ID of the team
,The number of members of the team
,Name of the team
,ID of the organization to which this team belongs
{
"description": "string",
"id": "string",
"membersCount": 0,
"name": "string",
"orgID": "string"
}Delete a team. Requires authentication and authorization as an admin user or an admin member of the organization.
Details for a team. Requires authentication and authorization as an admin user or a member of the organization.
Description of the team
,ID of the team
,The number of members of the team
,Name of the team
,ID of the organization to which this team belongs
{
"description": "string",
"id": "string",
"membersCount": 0,
"name": "string",
"orgID": "string"
}Update details for a team. Requires authentication and authorization as an admin user, an admin member of the organization, or an admin member of the team.
Description of the team
,ID of the team
,The number of members of the team
,Name of the team
,ID of the organization to which this team belongs
{
"description": "string",
"id": "string",
"membersCount": 0,
"name": "string",
"orgID": "string"
}Get options for syncing members of a team. Requires authentication and authorization as an admin user, an admin member of the organization, or an admin member of the team.
Whether to enable LDAP syncing. If false, all other fields are ignored
,The distinguished name of the LDAP group. Applicable only if selectGroupMembers is true, ignored otherwise
,The name of the LDAP group entry attribute which corresponds to distinguished names of members. Applicable only if selectGroupMembers is true, ignored otherwise
,The distinguished name of the element from which the LDAP server will search for users. Applicable only if selectGroupMembers is false, ignored otherwise
,The LDAP search filter used to select users if selectGroupMembers is false, may be left blank
,Whether to search for users in the entire subtree of the base DN or to only search one level under the base DN (if false). Applicable only if selectGroupMembers is false, ignored otherwise
,Whether to sync using a group DN and member attribute selection or to use a search filter (if false)
{
"enableSync": true,
"groupDN": "string",
"groupMemberAttr": "string",
"searchBaseDN": "string",
"searchFilter": "string",
"searchScopeSubtree": true,
"selectGroupMembers": true
}Set options for syncing members of a team. Enabling sync of team members will disable the ability to manually manage team membership for any users imported from LDAP. Their team membership is instead managed by the LDAP sync. Requires authentication and authorization as an admin user, an admin member of the organization, or an admin member of the team.
Whether to enable LDAP syncing. If false, all other fields are ignored
,The distinguished name of the LDAP group. Applicable only if selectGroupMembers is true, ignored otherwise
,The name of the LDAP group entry attribute which corresponds to distinguished names of members. Applicable only if selectGroupMembers is true, ignored otherwise
,The distinguished name of the element from which the LDAP server will search for users. Applicable only if selectGroupMembers is false, ignored otherwise
,The LDAP search filter used to select users if selectGroupMembers is false, may be left blank
,Whether to search for users in the entire subtree of the base DN or to only search one level under the base DN (if false). Applicable only if selectGroupMembers is false, ignored otherwise
,Whether to sync using a group DN and member attribute selection or to use a search filter (if false)
{
"enableSync": true,
"groupDN": "string",
"groupMemberAttr": "string",
"searchBaseDN": "string",
"searchFilter": "string",
"searchScopeSubtree": true,
"selectGroupMembers": true
}List members of a team. Lists memberships in ascending order by user ID. Requires authentication and authorization as an admin user or a member of the organization.
Whether the member is an admin of the organization or team
,The user which is a member of the organization or team
Full Name of the account
,ID of the account
,Whether the user is active and can login (users only)
,Whether the user is a system admin (users only)
,Whether the user was imported from an upstream identity provider
,Whether the account is an organization (or user)
,The number of members of the organization
,Name of the account
{
"members": [
{
"isAdmin": true,
"member": {
"fullName": "string",
"id": "string",
"isActive": true,
"isAdmin": true,
"isImported": true,
"isOrg": true,
"membersCount": 0,
"name": "string"
}
}
]
}Remove a member from a team. The user will remain a member of the organization. If team members are configured to be synced with LDAP, users which are imported from LDAP cannot be manually removed as members of the team and must be synced with LDAP. Requires authentication and authorization as an admin user, an admin member of the organization, or an admin member of the team.
Details of a user's membership in a team. Requires authentication and authorization as an admin user or a member of the organization.
Whether the member is an admin of the organization or team
,The user which is a member of the organization or team
Full Name of the account
,ID of the account
,Whether the user is active and can login (users only)
,Whether the user is a system admin (users only)
,Whether the user was imported from an upstream identity provider
,Whether the account is an organization (or user)
,The number of members of the organization
,Name of the account
{
"isAdmin": true,
"member": {
"fullName": "string",
"id": "string",
"isActive": true,
"isAdmin": true,
"isImported": true,
"isOrg": true,
"membersCount": 0,
"name": "string"
}
}Add a user to a team. The user will be added as a member of the organization if they are not already. If team members are configured to be synced with LDAP, users which are imported from LDAP cannot be manually added as members of the team and must be synced with LDAP. Requires authentication and authorization as an admin user, an admin member of the organization, or an admin member of the team.
Whether the member is an admin of the organization or team
,The user which is a member of the organization or team
Full Name of the account
,ID of the account
,Whether the user is active and can login (users only)
,Whether the user is a system admin (users only)
,Whether the user was imported from an upstream identity provider
,Whether the account is an organization (or user)
,The number of members of the organization
,Name of the account
{
"isAdmin": true,
"member": {
"fullName": "string",
"id": "string",
"isActive": true,
"isAdmin": true,
"isImported": true,
"isOrg": true,
"membersCount": 0,
"name": "string"
}
}Check the health of a UCP manager.
Use the _ping endpoint to check the health of a single UCP manager node. The UCP manager validates that all of its internal components are working, and it returns either 200, if all components are healthy, or 500, if any aren't healthy.
If you’re accessing the _ping endpoint through a load balancer, you have no way of knowing which UCP manager node isn't healthy, because any manager node may be serving your request. Make sure you’re connecting directly to the URL of a manager node, and not a load balancer.
Retrieve a single collection by path.
When the collection was created
,A unique ID for this collection
,A set of label constraints to be applied to any service or container created in this collection
,The key of the legacy authorization label for this collection
,The value of the legacy authorization label for this collection
,The name of the collection
,A list of collection IDs of parent collections
,The full path of the collection
,When the collection was updated
{
"created_at": "2019-04-21T11:26:59.727Z",
"id": "string",
"label_constraints": [
{
"equality": true,
"label_key": "string",
"label_value": "string",
"type": "string"
}
],
"legacylabelkey": "string",
"legacylabelvalue": "string",
"name": "string",
"parent_ids": [
"string"
],
"path": "string",
"updated_at": "2019-04-21T11:26:59.727Z"
}Lists all collection grants
ID of the object managed by the service
,ID of the role managed by the service
,ID of the subject of this grant
The account associated with this subject, if any
,ID of this subject
,The type of this subject (anonymous, authenticated, user, team, org)
,The team associated with this subject, if any
Full Name of the account
,ID of the account
,Whether the user is active and can login (users only)
,Whether the user is a system admin (users only)
,Whether the user was imported from an upstream identity provider
,Whether the account is an organization (or user)
,The number of members of the organization
,Name of the account
Description of the team
,ID of the team
,The number of members of the team
,Name of the team
,ID of the organization to which this team belongs
{
"grants": [
{
"objectID": "string",
"roleID": "string",
"subjectID": "string"
}
],
"subjects": [
{
"account": {
"fullName": "string",
"id": "string",
"isActive": true,
"isAdmin": true,
"isImported": true,
"isOrg": true,
"membersCount": 0,
"name": "string"
},
"id": "string",
"subject_type": "string",
"team": {
"description": "string",
"id": "string",
"membersCount": 0,
"name": "string",
"orgID": "string"
}
}
]
}Deletes a collection grant.
Creates a collection grant
List all visible collections.
When the collection was created
,A unique ID for this collection
,A set of label constraints to be applied to any service or container created in this collection
,The key of the legacy authorization label for this collection
,The value of the legacy authorization label for this collection
,The name of the collection
,A list of collection IDs of parent collections
,The full path of the collection
,When the collection was updated
[
{
"created_at": "2019-04-21T11:26:59.733Z",
"id": "string",
"label_constraints": [
{
"equality": true,
"label_key": "string",
"label_value": "string",
"type": "string"
}
],
"legacylabelkey": "string",
"legacylabelvalue": "string",
"name": "string",
"parent_ids": [
"string"
],
"path": "string",
"updated_at": "2019-04-21T11:26:59.733Z"
}
]Create a new collection of resources that share mutual authorization settings.
{
"id": "string"
}Delete a single collection by ID.
Retrieve a single collection by ID.
When the collection was created
,A unique ID for this collection
,A set of label constraints to be applied to any service or container created in this collection
,The key of the legacy authorization label for this collection
,The value of the legacy authorization label for this collection
,The name of the collection
,A list of collection IDs of parent collections
,The full path of the collection
,When the collection was updated
{
"created_at": "2019-04-21T11:26:59.736Z",
"id": "string",
"label_constraints": [
{
"equality": true,
"label_key": "string",
"label_value": "string",
"type": "string"
}
],
"legacylabelkey": "string",
"legacylabelvalue": "string",
"name": "string",
"parent_ids": [
"string"
],
"path": "string",
"updated_at": "2019-04-21T11:26:59.736Z"
}Updates an existing collection
Retrieve all children collection to a specific collection.
When the collection was created
,A unique ID for this collection
,A set of label constraints to be applied to any service or container created in this collection
,The key of the legacy authorization label for this collection
,The value of the legacy authorization label for this collection
,The name of the collection
,A list of collection IDs of parent collections
,The full path of the collection
,When the collection was updated
[
{
"created_at": "2019-04-21T11:26:59.739Z",
"id": "string",
"label_constraints": [
{
"equality": true,
"label_key": "string",
"label_value": "string",
"type": "string"
}
],
"legacylabelkey": "string",
"legacylabelvalue": "string",
"name": "string",
"parent_ids": [
"string"
],
"path": "string",
"updated_at": "2019-04-21T11:26:59.739Z"
}
]Delete the default collection setting for a user
Retrieve a user's default collection.
When the collection was created
,A unique ID for this collection
,A set of label constraints to be applied to any service or container created in this collection
,The key of the legacy authorization label for this collection
,The value of the legacy authorization label for this collection
,The name of the collection
,A list of collection IDs of parent collections
,The full path of the collection
,When the collection was updated
{
"created_at": "2019-04-21T11:26:59.741Z",
"id": "string",
"label_constraints": [
{
"equality": true,
"label_key": "string",
"label_value": "string",
"type": "string"
}
],
"legacylabelkey": "string",
"legacylabelvalue": "string",
"name": "string",
"parent_ids": [
"string"
],
"path": "string",
"updated_at": "2019-04-21T11:26:59.741Z"
}Set a user's default collection.
Retrieve the role for the logged-in user's default collection.
{
"id": "string",
"name": "string",
"operations": {},
"system_role": true
}Lists all namespaces for which a user has a grant
APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources
,Items is the list of Namespace objects in the list. More info: https://v1-8.docs.kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
,Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds
,Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds
APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources
,Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds
,Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata
,Spec defines the behavior of the Namespace. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#spec-and-status
,Status describes the current status of a Namespace. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#spec-and-status
continue may be set if the user set a limit on the number of items returned, and indicates that the server has more data available. The value is opaque and may be used to issue another request to the endpoint that served this list to retrieve the next set of available objects. Continuing a list may not be possible if the server configuration has changed or more than a few minutes have passed. The resourceVersion field returned when using this continue value will be identical to the value in the first response.
,String that identifies the server's internal version of this object that can be used by clients to determine when objects have changed. Value must be treated as opaque by clients and passed unmodified back to the server. Populated by the system. Read-only. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#concurrency-control-and-consistency
,selfLink is a URL representing this object. Populated by the system. Read-only.
Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: https://v1-8.docs.kubernetes.io/docs/concepts/overview/working-with-objects/annotations
,The name of the cluster which the object belongs to. This is used to distinguish resources with same name and namespace in different clusters. This field is not set anywhere right now and apiserver is going to ignore it if set in create or update request.
,CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata
,Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. May only be shortened. Read-only.
,DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field. Once set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested.
Populated by the system when a graceful deletion is requested. Read-only. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata
,Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed.
,GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server.
If this field is specified and the generated name exists, the server will NOT return a 409 - instead, it will either return 201 Created or 500 with Reason ServerTimeout indicating a unique name could not be found in the time allotted, and the client should retry (optionally after the time indicated in the Retry-After header).
Applied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#idempotency
,A sequence number representing a specific generation of the desired state. Populated by the system. Read-only.
,An initializer is a controller which enforces some system invariant at object creation time. This field is a list of initializers that have not yet acted on this object. If nil or empty, this object has been completely initialized. Otherwise, the object is considered uninitialized and is hidden (in list/watch and get calls) from clients that haven't explicitly asked to observe uninitialized objects.
When an object is created, the system will populate this list with the current set of initializers. Only privileged users may set or modify this list. Once it is empty, it may not be modified further by any user.
,Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: https://v1-8.docs.kubernetes.io/docs/concepts/overview/working-with-objects/labels
,Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: https://v1-8.docs.kubernetes.io/docs/concepts/overview/working-with-objects/names/
,Namespace defines the space within each name must be unique. An empty namespace is equivalent to the "default" namespace, but "default" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty.
Must be a DNS_LABEL. Cannot be updated. More info: https://v1-8.docs.kubernetes.io/docs/concepts/overview/working-with-objects/namespaces
,List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller.
,An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources.
Populated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#concurrency-control-and-consistency
,SelfLink is a URL representing this object. Populated by the system. Read-only.
,UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations.
Populated by the system. Read-only. More info: https://v1-8.docs.kubernetes.io/docs/concepts/overview/working-with-objects/names/
Finalizers is an opaque list of values that must be empty to permanently remove object from storage. More info: https://git.k8s.io/community/contributors/design-proposals/namespaces.md#finalizers
Phase is the current lifecycle phase of the namespace. More info: https://git.k8s.io/community/contributors/design-proposals/namespaces.md#phases
Pending is a list of initializers that must execute in order before this object is visible. When the last pending initializer is removed, and no failing result is set, the initializers struct will be set to nil and the object is considered as initialized and visible to all clients.
,If result is set with the Failure field, the object will be persisted to storage and then deleted, ensuring that other clients can observe the deletion.
API version of the referent.
,If true, AND if the owner has the "foregroundDeletion" finalizer, then the owner cannot be deleted from the key-value store until this reference is removed. Defaults to false. To set this field, a user needs "delete" permission of the owner, otherwise 422 (Unprocessable Entity) will be returned.
,If true, this reference points to the managing controller.
,Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds
,Name of the referent. More info: https://v1-8.docs.kubernetes.io/docs/concepts/overview/working-with-objects/names
,UID of the referent. More info: https://v1-8.docs.kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids
name of the process that is responsible for initializing this object.
APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources
,Suggested HTTP return code for this status, 0 if not set.
,Extended data associated with the reason. Each reason may define its own extended details. This field is optional and the data returned is not guaranteed to conform to any schema except that defined by the reason type.
,Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds
,A human-readable description of the status of this operation.
,Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds
,A machine-readable description of why this operation is in the "Failure" status. If this value is empty there is no information available. A Reason clarifies an HTTP status code but does not override it.
,Status of the operation. One of: "Success" or "Failure". More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#spec-and-status
The Causes array includes more details associated with the StatusReason failure. Not all StatusReasons may provide detailed causes.
,The group attribute of the resource associated with the status StatusReason.
,The kind attribute of the resource associated with the status StatusReason. On some operations may differ from the requested resource Kind. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds
,The name attribute of the resource associated with the status StatusReason (when there is a single name which can be described).
,If specified, the time in seconds before the operation should be retried. Some errors may indicate the client must take an alternate action - for those errors this field may indicate how long to wait before taking the alternate action.
,UID of the resource. (when there is a single resource which can be described). More info: https://v1-8.docs.kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids
The field of the resource that has caused this error, as named by its JSON serialization. May include dot and postfix notation for nested attributes. Arrays are zero-indexed. Fields may appear more than once in an array of causes due to fields having multiple errors. Optional.
Examples: "name" - the field "name" on the current resource "items[0].name" - the field "name" on the first array entry in "items"
,A human-readable description of the cause of the error. This field may be presented as-is to a reader.
,A machine-readable description of the cause of the error. If this value is empty there is no information available.
{
"apiVersion": "string",
"items": [
{
"apiVersion": "string",
"kind": "string",
"metadata": {
"annotations": {},
"clusterName": "string",
"creationTimestamp": "string",
"deletionGracePeriodSeconds": 0,
"deletionTimestamp": "string",
"finalizers": [
"string"
],
"generateName": "string",
"generation": 0,
"initializers": {
"pending": [
{
"name": "string"
}
],
"result": {
"apiVersion": "string",
"code": 0,
"details": {
"causes": [
{
"field": "string",
"message": "string",
"reason": "string"
}
],
"group": "string",
"kind": "string",
"name": "string",
"retryAfterSeconds": 0,
"uid": "string"
},
"kind": "string",
"message": "string",
"metadata": {
"continue": "string",
"resourceVersion": "string",
"selfLink": "string"
},
"reason": "string",
"status": "string"
}
},
"labels": {},
"name": "string",
"namespace": "string",
"ownerReferences": [
{
"apiVersion": "string",
"blockOwnerDeletion": true,
"controller": true,
"kind": "string",
"name": "string",
"uid": "string"
}
],
"resourceVersion": "string",
"selfLink": "string",
"uid": "string"
},
"spec": {
"finalizers": [
{}
]
},
"status": {
"phase": "string"
}
}
],
"kind": "string",
"metadata": {
"continue": "string",
"resourceVersion": "string",
"selfLink": "string"
}
}Lists all roles in the system.
[
{
"id": "string",
"name": "string",
"operations": {},
"system_role": true
}
]Creates a new custom role
The ID of the newly created role
[
{
"id": "string"
}
]Deletes a role by name
Retrieves a single role by ID
{
"id": "string",
"name": "string",
"operations": {},
"system_role": true
}Get stdout and stderr logs from a task.
Note: This endpoint works only for services with the json-file or journald logging drivers.
Returns a role with all operations that a user can perform against at least one collection in the system.
[
{
"id": "string",
"name": "string",
"operations": {},
"system_role": true
}
]Change a user's password. Requires authentication and authorization as an admin user or the target user.
Full Name of the account
,ID of the account
,Whether the user is active and can login (users only)
,Whether the user is a system admin (users only)
,Whether the user was imported from an upstream identity provider
,Whether the account is an organization (or user)
,The number of members of the organization
,Name of the account
{
"fullName": "string",
"id": "string",
"isActive": true,
"isAdmin": true,
"isImported": true,
"isOrg": true,
"membersCount": 0,
"name": "string"
}List a user's organization memberships. Lists organization memberships in ascending order by organization ID. Requires authentication and authorization as an admin user or the target user.
Whether the user is an admin of the organization
,The organization which the user is a member of
Full Name of the account
,ID of the account
,Whether the user is active and can login (users only)
,Whether the user is a system admin (users only)
,Whether the user was imported from an upstream identity provider
,Whether the account is an organization (or user)
,The number of members of the organization
,Name of the account
{
"memberOrgs": [
{
"isAdmin": true,
"org": {
"fullName": "string",
"id": "string",
"isActive": true,
"isAdmin": true,
"isImported": true,
"isOrg": true,
"membersCount": 0,
"name": "string"
}
}
]
}If the name is prefixed with the name of a node, the request is sent to the specified node. Use the '/' character to distinguish the node name, like testnode/testvolume.
List of volumes
,Warnings that occurred when fetching the list of volumes
Name of the volume driver used by the volume.
,User-defined key/value metadata.
,Mount path of the volume on the host.
,Name of the volume.
,The driver specific options used when creating the volume.
,The level at which the volume exists. Either global for cluster-wide, or local for machine level.
| string | |
|---|---|
| Default: | local |
| Enum: | "local", "global" |
Low-level details about the volume, provided by the volume driver.
Details are returned as a map with key/value pairs:
{"key":"value","key2":"value2"}.
The Status field is optional, and is omitted if the volume driver
does not support this feature.
Usage details about the volume. This information is used by the
GET /system/df endpoint, and omitted in other endpoints.
The number of containers referencing this volume. This field
is set to -1 if the reference-count is not available.
| integer | |
|---|---|
| Default: | -1 |
Amount of disk space used by the volume (in bytes). This information
is only available for volumes created with the "local" volume
driver. For volumes created with other volume drivers, this field
is set to -1 ("not available")
| integer | |
|---|---|
| Default: | -1 |
{
"Volumes": [
{
"Driver": "local",
"Labels": {
"com.example.some-label": "some-value",
"com.example.some-other-label": "some-other-value"
},
"Mountpoint": "/var/lib/docker/volumes/tardis",
"Name": "tardis",
"Options": {
"device": "tmpfs",
"o": "size=100m,uid=1000",
"type": "tmpfs"
},
"Scope": "local"
}
],
"Warnings": []
}Name of the volume driver used by the volume.
,User-defined key/value metadata.
,Mount path of the volume on the host.
,Name of the volume.
,The driver specific options used when creating the volume.
,The level at which the volume exists. Either global for cluster-wide, or local for machine level.
| string | |
|---|---|
| Default: | local |
| Enum: | "local", "global" |
Low-level details about the volume, provided by the volume driver.
Details are returned as a map with key/value pairs:
{"key":"value","key2":"value2"}.
The Status field is optional, and is omitted if the volume driver
does not support this feature.
Usage details about the volume. This information is used by the
GET /system/df endpoint, and omitted in other endpoints.
The number of containers referencing this volume. This field
is set to -1 if the reference-count is not available.
| integer | |
|---|---|
| Default: | -1 |
Amount of disk space used by the volume (in bytes). This information
is only available for volumes created with the "local" volume
driver. For volumes created with other volume drivers, this field
is set to -1 ("not available")
| integer | |
|---|---|
| Default: | -1 |
{
"Driver": "custom",
"Labels": {
"com.example.some-label": "some-value",
"com.example.some-other-label": "some-other-value"
},
"Mountpoint": "/var/lib/docker/volumes/tardis",
"Name": "tardis",
"Scope": "local",
"Status": {
"hello": "world"
}
}Disk space reclaimed in bytes
,Volumes that were deleted
{
"SpaceReclaimed": 0,
"VolumesDeleted": [
"string"
]
}Instruct the driver to remove the volume.
If the name is prefixed with the name of a node, the request is sent to the specified node. Use the '/' character to distinguish the node name, like testnode/testvolume.
Name of the volume driver used by the volume.
,User-defined key/value metadata.
,Mount path of the volume on the host.
,Name of the volume.
,The driver specific options used when creating the volume.
,The level at which the volume exists. Either global for cluster-wide, or local for machine level.
| string | |
|---|---|
| Default: | local |
| Enum: | "local", "global" |
Low-level details about the volume, provided by the volume driver.
Details are returned as a map with key/value pairs:
{"key":"value","key2":"value2"}.
The Status field is optional, and is omitted if the volume driver
does not support this feature.
Usage details about the volume. This information is used by the
GET /system/df endpoint, and omitted in other endpoints.
The number of containers referencing this volume. This field
is set to -1 if the reference-count is not available.
| integer | |
|---|---|
| Default: | -1 |
Amount of disk space used by the volume (in bytes). This information
is only available for volumes created with the "local" volume
driver. For volumes created with other volume drivers, this field
is set to -1 ("not available")
| integer | |
|---|---|
| Default: | -1 |
{
"Driver": "custom",
"Labels": {
"com.example.some-label": "some-value",
"com.example.some-other-label": "some-other-value"
},
"Mountpoint": "/var/lib/docker/volumes/tardis",
"Name": "tardis",
"Scope": "local",
"Status": {
"hello": "world"
}
}