← Teams

Sharing controls

By default, any team member can share their VMs publicly or with people outside the team. Admins can lock this down so that only admins (and the billing owner) decide how broadly team VMs are exposed, or turn new VM sharing off entirely.

Viewing settings

Run team settings to see the current sharing mode:

team settings

Team settings:
  vm-sharing: all-members

Changing the sharing mode

Only team admins and the billing owner can change sharing settings:

team settings vm-sharing <off|admins-only|all-members>

There are three modes:

  • all-members (default). Any team member can make a VM public (share set-public) and grant Web or Root access to external accounts (share add <vm> <email> [--root]).
  • admins-only. Regular members can no longer make VMs public or grant access to people outside the team. Only admins and the billing owner can.
  • off. Nobody on the team, including admins and the billing owner, can create a new share of any kind: public (share set-public), link (share add-link), named Web or Root access (share add <vm> <email> [--root]) even to teammates, team-wide (share add <vm> team [--root]), or SSO (share sso <vm> on).

Switching to admins-only:

team settings vm-sharing admins-only

Under admins-only, sharing a VM with the whole team (share add <vm> team) and granting the whole team Root access (share add <vm> team --root) are unaffected. Under off, they are blocked too.

off is not retroactive. Existing public VMs, links, named grants, team shares, and SSO shares keep working, and old links and pending invitations can still grant access. Removal commands (share remove, share remove-link, share set-private, share sso <vm> off) stay available.

See the sharing docs for how the underlying share mechanisms work, and Team VMs for team-scoped sharing.