= SAML is a supported user authentication method for Universal Control Plane (UCP). UCP has its own built-in authentication mechanism and integrates with LDAP and Active Directory. It also supports Role Based Access Control (RBAC) and Docker Content Trust. UCP allows you to configure SAML as an authentication method and connect it to your Identity Provider (IdP). You need to provide the Entity ID and the ACS URL from UCP to your IdP, and the SAML Sign-on URL and the x509 Certificate from your IdP to UCP12. References:
* SAML | Docker Docs
* Configure Single Sign-On | Docker Docs

A DTR security scan will not detect image configuration poor practices, such as exposed ports or inclusion of compilers in production images. A DTR security scan is designed to discover vulnerabilities in the images based on the MITRE CVE or NIST NVD databases1. It does not check the image configuration or best practices. To check the image configuration and best practices, you can use other tools, such as Dockerfile Linter) or Docker Bench for Security). References: Vulnerability scanning must be enabled for all repositories in the Docker Trusted Registry (DTR) component of Docker Enterprise), Dockerfile Linter), Docker Bench for Security)

Docker will block the command docker container run myorg/myimage:1.0 if the image tag myorg/myimage:1.0 is unsigned and the environment variable DOCKER_CONTENT_TRUST=1 is set. The reason is that setting DOCKER_CONTENT_TRUST=1 enables Docker Content Trust (DCT), which is a feature that allows users to verify the integrity and publisher of Docker images using digital signatures1.
When DCT is enabled, Docker will only pull, run, or build images that have valid signatures. If an image tag is unsigned or has an invalid signature, Docker will reject the operation and display an error message2. Therefore, to run an unsigned image with DCT enabled, you need to either disable DCT by setting DOCKER_CONTENT_TRUST=0 or use the --disable-content-trust flag, or sign the image tag with a valid key3. References:
* Content trust in Docker
* Determine if Docker image is signed or unsigned
* Signing Images and Enabling Docker Content Trust

Tagging the image with 'nginx:immutable' is not how a user can prevent an image, such as 'nginx:latest', from being overwritten by another user with push access to the repository. Tagging the image with
'nginx:immutable' will only create a new tag for the image, but it will not prevent the original tag from being overwritten. To prevent an image tag from being overwritten in Docker Trusted Registry, the user can use the DTR web UI to make the tag immutable1. This will prevent anyone from pushing a new image with the same tag, even if they have push access to the repository1. Alternatively, the user can also use the DTR API to make the tag immutable2. References: Prevent tags from being overwritten), DTR API reference)

= Manually downloading the 'docker-ee' package will not upgrade Docker Engine CE to Docker Engine EE.
Docker Engine CE and Docker Engine EE are two different products with different installation methods and features. Docker Engine CE is a free and open source containerization platform, while Docker Engine EE is a subscription-based enterprise-grade platform that offers additional features such as security scanning, certified plugins, and support12. To upgrade from Docker Engine CE to Docker Engine EE, you need to uninstall Docker Engine CE and install Docker Engine EE following the official documentation3. References:
* What is the exact difference between Docker EE (Enterprise Edition), Docker CE (Community Edition) and Docker (Custom Support) - Stack Overflow
* Difference between Docker Community Edition (CE) vs Docker Enterprise Edition (EE) in 2020
* Install Docker Engine | Docker Docs