Share Images Across Tenants
Overview
An image with Shared visibility can be made available to specific tenants beyond the one that owns it. This lets a user in one tenant provision virtual machines from an image that another tenant uploaded, without making that image public to every tenant in the domain.
Sharing is a two-sided workflow. On the owning side, you add target tenants to the image's Tenant Access list. On the receiving side, a user in each target tenant accepts the image from the Accept Shared Images drawer. Until a target tenant accepts, the image stays out of that tenant's image list. After acceptance, the image appears in the tenant's image list, where any user in that tenant can select it when creating virtual machines. This design keeps a tenant's image list free of images it has not explicitly opted into.
Images uploaded with the pcdctl CLI have Shared visibility by default. Images uploaded through the UI are Private by default, so you choose Shared when you upload the image or change its visibility afterwards. For the full set of visibility options, see Control Image Visibility.
In this guide, you will share an image with another tenant, accept a shared image from the receiving tenant, and stop sharing an image.
Prerequisites
You can manage sharing for the image. Administrators can share any image. Users with the Self-Service User role can share only images that their own tenant owns. A tenant that received a shared image cannot share it onward, so the Tenant Access list does not appear when a non-administrator edits an image owned by another tenant.
You can select the target tenant. Administrators can share with any tenant in the domain. Users with the Self-Service User role can share only with tenants they are a member of, so the Tenant Access list shows only those tenants.
The receiving user can accept images. Accepting is a write operation. Read-only users do not see the Accept Shared Images button.
Share an Image with a Tenant
Add one or more target tenants to an image's Tenant Access list so that users in those tenants can accept and use the image.
Sign in to the Private Cloud Director UI and navigate to Virtual Machines in the left-hand navigation menu, then go to Images and VM Snapshots > Images.
Select the image in the images grid, then choose Edit from the Actions menu. The Edit Image dialog opens.
Set Visibility to Shared. The Tenant Access list appears below the visibility field. The list never includes the tenant that owns the image.
Select each tenant you want to share the image with.
Select Update Image.
The image is now shared with the selected tenants. It does not appear in their image lists until a user in each tenant accepts it, as described in Accept a Shared Image.
You can also share an image at upload time. In the image upload dialog, set Visibility to Shared and select tenants in the Tenant Access list that appears. See Upload an Image Using the UI.
Share an Image Using the CLI
The UI is the primary path for sharing images. If you prefer the pcdctl CLI, first set the image's visibility to Shared, then add each target tenant by name or ID:
A user in the target tenant must still accept the image before it appears in that tenant's image list.
Accept a Shared Image
When another tenant shares an image with your tenant, accept it before it appears in your tenant's image list. Accepting applies to the tenant you are currently working in and makes the image available to every user in that tenant, so accept images only from sources you trust.
Sign in to the Private Cloud Director UI, make sure the tenant the image was shared with is the current tenant, and navigate to Virtual Machines in the left-hand navigation menu, then go to Images and VM Snapshots > Images.
Select Accept Shared Images. A drawer opens listing the images shared with your tenant that are awaiting a decision. The Owner Tenant column shows which tenant shared each image.
For each image, select Accept to add it to your tenant's image list, or Deny to decline it.
Deny hides the image but does not revoke access. A denied image stays out of your tenant's image list, but a user in your tenant who knows the image ID can still create a virtual machine from it. Only the image owner can revoke access, by removing your tenant from the image's Tenant Access list.
Accepted images appear in your tenant's image list, where you can select them when creating virtual machines.
Accept a Shared Image Using the CLI
The UI is the primary path for accepting shared images. If you prefer the pcdctl CLI, run the following commands with credentials scoped to the receiving tenant. A pending image is not in your tenant's default image list, so list the pending shared images first to get the image ID, then accept the image by ID:
To decline a shared image instead, use --reject in place of --accept.
Stop Sharing an Image
You can remove specific tenants from a shared image or stop sharing it entirely. A tenant that loses access no longer sees the image in its image list and can no longer create virtual machines from it. Removing a tenant is the only way to revoke its access; a tenant that denies a shared image only hides it from its own image list.
Navigate to Virtual Machines > Images and VM Snapshots > Images, select the image in the images grid, then choose Edit from the Actions menu.
Do one of the following:
To remove specific tenants, clear their selection in the Tenant Access list and select Update Image. The image keeps Shared visibility for the remaining tenants.
To stop sharing entirely, set Visibility to Private and select Update Image. If the image is shared with any tenants, a Revoke Shared Access? confirmation appears. Confirm to remove every tenant's access.
Stop Sharing an Image Using the CLI
If you prefer the pcdctl CLI, remove a tenant from the image with the following command:
Related Pages
Overview: image library concepts, image import, and the full list of visibility options
Upload an Image Using the UI: upload an image before sharing it with another tenant
RBAC Roles and Permissions: which roles can upload, share, and accept images
Last updated
Was this helpful?