> For the complete documentation index, see [llms.txt](https://docs.platform9.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.platform9.com/private-cloud-director/images-and-image-library/share-images-across-tenants.md).

# Share Images Across Tenants

## Overview

An image with **Shared** visibility can be made available to specific tenants beyond the one that owns it. This lets a user in one tenant provision virtual machines from an image that another tenant uploaded, without making that image public to every tenant in the domain.

Sharing is a two-sided workflow. On the owning side, you add target tenants to the image's **Tenant Access** list. On the receiving side, a user in each target tenant accepts the image from the **Accept Shared Images** drawer. Until a target tenant accepts, the image stays out of that tenant's image list. After acceptance, the image appears in the tenant's image list, where any user in that tenant can select it when creating virtual machines. This design keeps a tenant's image list free of images it has not explicitly opted into.

Images uploaded with the `pcdctl` CLI have **Shared** visibility by default. Images uploaded through the UI are **Private** by default, so you choose **Shared** when you upload the image or change its visibility afterwards. For the full set of visibility options, see [Control Image Visibility](/private-cloud-director/images-and-image-library/image-library---images.md#control-image-visibility).

In this guide, you will share an image with another tenant, accept a shared image from the receiving tenant, and stop sharing an image.

## Prerequisites

* **You can manage sharing for the image.** Administrators can share any image. Users with the **Self-Service User** role can share only images that their own tenant owns. A tenant that received a shared image cannot share it onward, so the **Tenant Access** list does not appear when a non-administrator edits an image owned by another tenant.
* **You can select the target tenant.** Administrators can share with any tenant in the domain. Users with the **Self-Service User** role can share only with tenants they are a member of, so the **Tenant Access** list shows only those tenants.
* **The receiving user can accept images.** Accepting is a write operation. Read-only users do not see the **Accept Shared Images** button.

## Share an Image with a Tenant

Add one or more target tenants to an image's **Tenant Access** list so that users in those tenants can accept and use the image.

1. Sign in to the <code class="expression">space.vars.product\_name</code> UI and navigate to **Images** in the left-hand navigation menu.
2. Select the image in the images grid, then choose **Edit** from the Actions menu. The **Edit Image** dialog opens.
3. Set **Visibility** to **Shared**. The **Tenant Access** list appears below the visibility field. The list never includes the tenant that owns the image.
4. Select each tenant you want to share the image with.
5. Select **Update Image**.

The image is now shared with the selected tenants. It does not appear in their image lists until a user in each tenant accepts it, as described in [Accept a Shared Image](#accept-a-shared-image).

You can also share an image at upload time. In the image upload dialog, set **Visibility** to **Shared** and select tenants in the **Tenant Access** list that appears. See [Upload an Image Using the UI](/private-cloud-director/images-and-image-library/image-upload-via-ui.md).

### Share an Image Using the CLI

The UI is the primary path for sharing images. If you prefer the `pcdctl` CLI, first set the image's visibility to **Shared**, then add each target tenant by name or ID:

{% tabs %}
{% tab title="Bash" %}

```bash
pcdctl image set --shared <image-id-or-name>
pcdctl image add project <image-id-or-name> <target-tenant>
```

{% endtab %}
{% endtabs %}

A user in the target tenant must still accept the image before it appears in that tenant's image list.

## Accept a Shared Image

When another tenant shares an image with your tenant, accept it before it appears in your tenant's image list. Accepting applies to the tenant you are currently working in and makes the image available to every user in that tenant, so accept images only from sources you trust.

1. Sign in to the <code class="expression">space.vars.product\_name</code> UI, make sure the tenant the image was shared with is the current tenant, and navigate to **Images** in the left-hand navigation menu.
2. Select **Accept Shared Images**. A drawer opens listing the images shared with your tenant that are awaiting a decision. The **Owner Tenant** column shows which tenant shared each image.
3. For each image, select **Accept** to add it to your tenant's image list, or **Deny** to decline it.

{% hint style="warning" %}
**Deny hides the image but does not revoke access.** A denied image stays out of your tenant's image list, but a user in your tenant who knows the image ID can still create a virtual machine from it. Only the image owner can revoke access, by removing your tenant from the image's **Tenant Access** list.
{% endhint %}

Accepted images appear in your tenant's image list, where you can select them when creating virtual machines.

### Accept a Shared Image Using the CLI

The UI is the primary path for accepting shared images. If you prefer the `pcdctl` CLI, run the following commands with credentials scoped to the receiving tenant. A pending image is not in your tenant's default image list, so list the pending shared images first to get the image ID, then accept the image by ID:

{% tabs %}
{% tab title="Bash" %}

```bash
pcdctl image list --shared --member-status pending
pcdctl image set --accept <image-id>
```

{% endtab %}
{% endtabs %}

To decline a shared image instead, use `--reject` in place of `--accept`.

## Stop Sharing an Image

You can remove specific tenants from a shared image or stop sharing it entirely. A tenant that loses access no longer sees the image in its image list and can no longer create virtual machines from it. Removing a tenant is the only way to revoke its access; a tenant that denies a shared image only hides it from its own image list.

1. Navigate to **Images**, select the image in the images grid, then choose **Edit** from the Actions menu.
2. Do one of the following:
   * To remove specific tenants, clear their selection in the **Tenant Access** list and select **Update Image**. The image keeps **Shared** visibility for the remaining tenants.
   * To stop sharing entirely, set **Visibility** to **Private** and select **Update Image**. If the image is shared with any tenants, a **Revoke Shared Access?** confirmation appears. Confirm to remove every tenant's access.

### Stop Sharing an Image Using the CLI

If you prefer the `pcdctl` CLI, remove a tenant from the image with the following command:

{% tabs %}
{% tab title="Bash" %}

```bash
pcdctl image remove project <image-id-or-name> <target-tenant>
```

{% endtab %}
{% endtabs %}

## Related Pages

* [Overview](/private-cloud-director/images-and-image-library/image-library---images.md): image library concepts, image import, and the full list of visibility options
* [Upload an Image Using the UI](/private-cloud-director/images-and-image-library/image-upload-via-ui.md): upload an image before sharing it with another tenant
* [RBAC Roles and Permissions](/private-cloud-director/identity-and-multi-tenancy/rbac-roles-and-permissions.md): which roles can upload, share, and accept images


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.platform9.com/private-cloud-director/images-and-image-library/share-images-across-tenants.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.