The option in Universal Control Plane (UCP) allowing users and administrators to schedule containers on all nodes, including UCP managers and Docker Trusted Registry (DTR) nodes must be disabled in Docker Enterprise.

No profile (default benchmark)

I - Mission Critical Classified

I - Mission Critical Public

I - Mission Critical Sensitive

II - Mission Support Classified

II - Mission Support Public

II - Mission Support Sensitive

III - Administrative Classified

III - Administrative Public

III - Administrative Sensitive