# Sharing controls


By default, any team member can share their VMs publicly or with people
outside the team. Admins can lock this down so that only admins (and the
billing owner) decide how broadly team VMs are exposed, turn new VM sharing
off entirely, or stop VMs from being made public.

## Viewing settings

Run `team settings` to see the current sharing settings:

```
team settings
```

```
Team settings:
  vm-sharing: all-members
  public-sharing: on
```

## Changing the sharing mode

Only team admins and the billing owner can change sharing settings:

```
team settings vm-sharing <off|admins-only|all-members>
```

There are three modes:

- **`all-members`** (default). Any team member can make a VM public
  (`share set-public`) and grant Web or Root access to external accounts
  (`share add <vm> <email> [--root]`).
- **`admins-only`**. Regular members can no longer make VMs public or grant
  access to people outside the team. Only admins and the billing owner can.
- **`off`**. Nobody on the team, including admins and the billing owner, can
  create a new share of any kind: public (`share set-public`), link
  (`share add-link`), named Web or Root access (`share add <vm> <email>
  [--root]`) even to teammates, team-wide (`share add <vm> team [--root]`), or
  SSO (`share sso <vm> on`).

Switching to `admins-only`:

```
team settings vm-sharing admins-only
```

Under `admins-only`, sharing a VM with the whole team (`share add <vm> team`)
and granting the whole team Root access (`share add <vm> team --root`) are
unaffected. Under `off`, they are blocked too.

`off` is not retroactive. Existing public VMs, links, named grants, team
shares, and SSO shares keep working, and old links and pending invitations can
still grant access. Removal commands (`share remove`, `share remove-link`,
`share set-private`, `share sso <vm> off`) stay available.

## Turning off public sharing

Public sharing is on by default. Admins and the billing owner can turn it off
to stop VMs from being made public, meaning reachable on the web without
logging in:

```
team settings public-sharing <on|off>
```

For example:

```
team settings public-sharing off
```

While public sharing is off, `share set-public` is refused for every role on
the team, including admins and the billing owner. Share links
(`share add-link`) and named or team shares (`share add <vm> <email>
[--root]`, `share add <vm> team [--root]`) are unaffected by this setting;
`vm-sharing` still governs them.

This setting is independent of `vm-sharing`. Under `vm-sharing admins-only`,
admins can still make VMs public unless public sharing is also off, and under
`vm-sharing off`, `share set-public` is refused either way.

Turning public sharing off is not retroactive. A VM that is already public
stays public until it is made private with `share set-private`, which always
works. Once the VM is private, it cannot be made public again until an admin
runs `team settings public-sharing on`. Copying a public VM with `cp` makes a
private copy.

See the [sharing docs](/docs/sharing) for how the underlying share
mechanisms work, and [Team VMs](/docs/teams/vms) for team-scoped sharing.