diff --git a/lib/config/admin.ts b/lib/config/admin.ts
new file mode 100644
index 0000000000000000000000000000000000000000..4881d2dfc03c1f192550d73bd01df6f57df5c234
--- /dev/null
+++ b/lib/config/admin.ts
@@ -0,0 +1,21 @@
+import { RenovateConfig, RepoAdminConfig } from './common';
+
+let adminConfig: RepoAdminConfig = {};
+
+const derivedAdminOptions = ['localDir'];
+
+export function setAdminConfig(
+  config: RenovateConfig,
+  adminOptions: string[]
+): void {
+  adminConfig = {};
+  const repoAdminOptions = adminOptions.concat(derivedAdminOptions);
+  for (const option of repoAdminOptions) {
+    adminConfig[option] = config[option];
+    // TODO: delete from config
+  }
+}
+
+export function getAdminConfig(): RepoAdminConfig {
+  return adminConfig;
+}
diff --git a/lib/config/common.ts b/lib/config/common.ts
index c7ecbd654104cba95fe5543bf81e5364162ca6a4..4fff9774bc7841eb7fb258e6dd2913b6e89015e6 100644
--- a/lib/config/common.ts
+++ b/lib/config/common.ts
@@ -63,6 +63,11 @@ export interface RenovateSharedConfig {
   unicodeEmoji?: boolean;
 }
 
+export interface RepoAdminConfig {
+  dockerImagePrefix?: string;
+  dockerUser?: string;
+}
+
 export interface RenovateAdminConfig {
   allowPostUpgradeCommandTemplating?: boolean;
   allowedPostUpgradeCommands?: string[];
@@ -74,8 +79,6 @@ export interface RenovateAdminConfig {
   configWarningReuseIssue?: boolean;
 
   customEnvVariables?: Record<string, string>;
-  dockerImagePrefix?: string;
-  dockerUser?: string;
 
   dryRun?: boolean;
 
diff --git a/lib/config/definitions.ts b/lib/config/definitions.ts
index 0d05c1634201c3bdea47a5ab34c2d15547f9a672..69cbd80ee6fe78e23464a1d0f059465c55010c9d 100644
--- a/lib/config/definitions.ts
+++ b/lib/config/definitions.ts
@@ -1920,6 +1920,10 @@ export function getOptions(): RenovateOptions[] {
   return options;
 }
 
+export function getAdminOptionNames(): string[] {
+  return options.filter((option) => option.admin).map((option) => option.name);
+}
+
 function loadManagerOptions(): void {
   for (const [name, config] of getManagers().entries()) {
     if (config.defaultConfig) {
diff --git a/lib/manager/bundler/__snapshots__/artifacts.spec.ts.snap b/lib/manager/bundler/__snapshots__/artifacts.spec.ts.snap
index 8119b8875c47f1f50856e96752d76daf42b7e95c..a2af9c9e785d27efd483913f6b19a4d8de156d54 100644
--- a/lib/manager/bundler/__snapshots__/artifacts.spec.ts.snap
+++ b/lib/manager/bundler/__snapshots__/artifacts.spec.ts.snap
@@ -26,7 +26,7 @@ Array [
     },
   },
   Object {
-    "cmd": "docker run --rm --name=renovate_ruby --label=renovate_child --user=foobar -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -v \\"/tmp/cache\\":\\"/tmp/cache\\" -e GEM_HOME -w \\"/tmp/github/some/repo\\" renovate/ruby:1.2.0 bash -l -c \\"ruby --version && gem install bundler && bundle lock --update foo bar\\"",
+    "cmd": "docker run --rm --name=renovate_ruby --label=renovate_child -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -v \\"/tmp/cache\\":\\"/tmp/cache\\" -e GEM_HOME -w \\"/tmp/github/some/repo\\" renovate/ruby:1.2.0 bash -l -c \\"ruby --version && gem install bundler && bundle lock --update foo bar\\"",
     "options": Object {
       "cwd": "/tmp/github/some/repo",
       "encoding": "utf-8",
@@ -73,7 +73,7 @@ Array [
     },
   },
   Object {
-    "cmd": "docker run --rm --name=renovate_ruby --label=renovate_child --user=foobar -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -v \\"/tmp/cache\\":\\"/tmp/cache\\" -e GEM_HOME -w \\"/tmp/github/some/repo\\" renovate/ruby:latest bash -l -c \\"ruby --version && gem install bundler -v 3.2.1 && bundle lock --update foo bar\\"",
+    "cmd": "docker run --rm --name=renovate_ruby --label=renovate_child -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -v \\"/tmp/cache\\":\\"/tmp/cache\\" -e GEM_HOME -w \\"/tmp/github/some/repo\\" renovate/ruby:latest bash -l -c \\"ruby --version && gem install bundler -v 3.2.1 && bundle lock --update foo bar\\"",
     "options": Object {
       "cwd": "/tmp/github/some/repo",
       "encoding": "utf-8",
@@ -120,7 +120,7 @@ Array [
     },
   },
   Object {
-    "cmd": "docker run --rm --name=renovate_ruby --label=renovate_child --user=foobar -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -v \\"/tmp/cache\\":\\"/tmp/cache\\" -e BUNDLE_GEMS__PRIVATE__COM -e GEM_HOME -w \\"/tmp/github/some/repo\\" renovate/ruby:1.2.0 bash -l -c \\"ruby --version && gem install bundler && bundle lock --update foo bar\\"",
+    "cmd": "docker run --rm --name=renovate_ruby --label=renovate_child -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -v \\"/tmp/cache\\":\\"/tmp/cache\\" -e BUNDLE_GEMS__PRIVATE__COM -e GEM_HOME -w \\"/tmp/github/some/repo\\" renovate/ruby:1.2.0 bash -l -c \\"ruby --version && gem install bundler && bundle lock --update foo bar\\"",
     "options": Object {
       "cwd": "/tmp/github/some/repo",
       "encoding": "utf-8",
@@ -168,7 +168,7 @@ Array [
     },
   },
   Object {
-    "cmd": "docker run --rm --name=renovate_ruby --label=renovate_child --user=foobar -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -v \\"/tmp/cache\\":\\"/tmp/cache\\" -e GEM_HOME -w \\"/tmp/github/some/repo\\" renovate/ruby:latest bash -l -c \\"ruby --version && gem install bundler && bundle lock --update foo bar\\"",
+    "cmd": "docker run --rm --name=renovate_ruby --label=renovate_child -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -v \\"/tmp/cache\\":\\"/tmp/cache\\" -e GEM_HOME -w \\"/tmp/github/some/repo\\" renovate/ruby:latest bash -l -c \\"ruby --version && gem install bundler && bundle lock --update foo bar\\"",
     "options": Object {
       "cwd": "/tmp/github/some/repo",
       "encoding": "utf-8",
diff --git a/lib/manager/bundler/artifacts.spec.ts b/lib/manager/bundler/artifacts.spec.ts
index 8b4d3664528faba96ae57ef54f6e8a92fedfffcd..56ce54ee60af416f00f0c365a1bca13287554301 100644
--- a/lib/manager/bundler/artifacts.spec.ts
+++ b/lib/manager/bundler/artifacts.spec.ts
@@ -38,7 +38,6 @@ describe('bundler.updateArtifacts()', () => {
       // `join` fixes Windows CI
       localDir: join('/tmp/github/some/repo'),
       cacheDir: join('/tmp/cache'),
-      dockerUser: 'foobar',
     };
 
     env.getChildProcessEnv.mockReturnValue(envMock.basic);
@@ -173,7 +172,6 @@ describe('bundler.updateArtifacts()', () => {
           config: {
             ...config,
             binarySource: BinarySource.Docker,
-            dockerUser: 'foobar',
             constraints: {
               ruby: '1.2.5',
               bundler: '3.2.1',
@@ -206,7 +204,6 @@ describe('bundler.updateArtifacts()', () => {
           config: {
             ...config,
             binarySource: BinarySource.Docker,
-            dockerUser: 'foobar',
             constraints: {
               ruby: 'foo',
               bundler: 'bar',
diff --git a/lib/manager/cargo/__snapshots__/artifacts.spec.ts.snap b/lib/manager/cargo/__snapshots__/artifacts.spec.ts.snap
index 4c0587bb0020975a44fa35a4ff2bf907f02c1c34..466774fff14d6bfc0f576da2b82d82585957b41c 100644
--- a/lib/manager/cargo/__snapshots__/artifacts.spec.ts.snap
+++ b/lib/manager/cargo/__snapshots__/artifacts.spec.ts.snap
@@ -95,7 +95,7 @@ Array [
     },
   },
   Object {
-    "cmd": "docker run --rm --name=renovate_rust --label=renovate_child --user=foobar -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -w \\"/tmp/github/some/repo\\" renovate/rust bash -l -c \\"cargo update --manifest-path Cargo.toml --package dep1\\"",
+    "cmd": "docker run --rm --name=renovate_rust --label=renovate_child -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -w \\"/tmp/github/some/repo\\" renovate/rust bash -l -c \\"cargo update --manifest-path Cargo.toml --package dep1\\"",
     "options": Object {
       "cwd": "/tmp/github/some/repo",
       "encoding": "utf-8",
diff --git a/lib/manager/cargo/artifacts.spec.ts b/lib/manager/cargo/artifacts.spec.ts
index 50bba66fa8bdc5e86aa27422f5cad1525b25f6ad..021a9477bf4bd5776aa0bb8166b34846b9dfcee4 100644
--- a/lib/manager/cargo/artifacts.spec.ts
+++ b/lib/manager/cargo/artifacts.spec.ts
@@ -22,7 +22,6 @@ const env = mocked(_env);
 const config = {
   // `join` fixes Windows CI
   localDir: join('/tmp/github/some/repo'),
-  dockerUser: 'foobar',
 };
 
 describe('.updateArtifacts()', () => {
diff --git a/lib/manager/cocoapods/__snapshots__/artifacts.spec.ts.snap b/lib/manager/cocoapods/__snapshots__/artifacts.spec.ts.snap
index 30b580dd68cf56817c2d3ec8dfe36b261449ef46..a0579ac4f55f2529892ddb4c3eb235637f865e9d 100644
--- a/lib/manager/cocoapods/__snapshots__/artifacts.spec.ts.snap
+++ b/lib/manager/cocoapods/__snapshots__/artifacts.spec.ts.snap
@@ -34,7 +34,7 @@ Array [
     },
   },
   Object {
-    "cmd": "docker run --rm --name=renovate_cocoapods --label=renovate_child --user=ubuntu -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -v \\"/tmp/cache\\":\\"/tmp/cache\\" -e CP_HOME_DIR -w \\"/tmp/github/some/repo\\" renovate/cocoapods:1.2.4 bash -l -c \\"pod install\\"",
+    "cmd": "docker run --rm --name=renovate_cocoapods --label=renovate_child -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -v \\"/tmp/cache\\":\\"/tmp/cache\\" -e CP_HOME_DIR -w \\"/tmp/github/some/repo\\" renovate/cocoapods:1.2.4 bash -l -c \\"pod install\\"",
     "options": Object {
       "cwd": "/tmp/github/some/repo",
       "encoding": "utf-8",
@@ -76,7 +76,7 @@ Array [
     },
   },
   Object {
-    "cmd": "docker run --rm --name=renovate_cocoapods --label=renovate_child --user=ubuntu -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -v \\"/tmp/cache\\":\\"/tmp/cache\\" -e CP_HOME_DIR -w \\"/tmp/github/some/repo\\" renovate/cocoapods:latest bash -l -c \\"pod install\\"",
+    "cmd": "docker run --rm --name=renovate_cocoapods --label=renovate_child -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -v \\"/tmp/cache\\":\\"/tmp/cache\\" -e CP_HOME_DIR -w \\"/tmp/github/some/repo\\" renovate/cocoapods:latest bash -l -c \\"pod install\\"",
     "options": Object {
       "cwd": "/tmp/github/some/repo",
       "encoding": "utf-8",
diff --git a/lib/manager/cocoapods/artifacts.spec.ts b/lib/manager/cocoapods/artifacts.spec.ts
index a0c00dd30a30e2e6fa76defdc4ee29f6a828c751..42013554b3d33ac064632789faafa2bf5e974a74 100644
--- a/lib/manager/cocoapods/artifacts.spec.ts
+++ b/lib/manager/cocoapods/artifacts.spec.ts
@@ -190,7 +190,6 @@ describe('.updateArtifacts()', () => {
     await setExecConfig({
       ...config,
       binarySource: 'docker',
-      dockerUser: 'ubuntu',
     });
 
     fs.readFile.mockResolvedValueOnce('COCOAPODS: 1.2.4' as any);
@@ -215,7 +214,6 @@ describe('.updateArtifacts()', () => {
     await setExecConfig({
       ...config,
       binarySource: 'docker',
-      dockerUser: 'ubuntu',
     });
 
     fs.readFile.mockResolvedValueOnce('COCOAPODS: 1.2.4' as any);
diff --git a/lib/manager/common.ts b/lib/manager/common.ts
index 249fdfa1444c47bde98ae219ce95a3ec83a449ba..706499ec1d2ebbbd2aea29667f90ae275250ff98 100644
--- a/lib/manager/common.ts
+++ b/lib/manager/common.ts
@@ -11,7 +11,6 @@ export type Result<T> = T | Promise<T>;
 
 export interface ManagerConfig {
   binarySource?: string;
-  dockerUser?: string;
   localDir?: string;
   registryUrls?: string[];
 }
diff --git a/lib/manager/composer/__snapshots__/artifacts.spec.ts.snap b/lib/manager/composer/__snapshots__/artifacts.spec.ts.snap
index d951aef967b9f1d4f11c1af08819c8397cbfd52e..cb1980f0cf072e4901e8e6386024c0e328950d3d 100644
--- a/lib/manager/composer/__snapshots__/artifacts.spec.ts.snap
+++ b/lib/manager/composer/__snapshots__/artifacts.spec.ts.snap
@@ -133,7 +133,7 @@ Array [
     },
   },
   Object {
-    "cmd": "docker run --rm --name=renovate_composer --label=renovate_child --user=foobar -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -v \\"/tmp/renovate/cache\\":\\"/tmp/renovate/cache\\" -e COMPOSER_CACHE_DIR -w \\"/tmp/github/some/repo\\" renovate/composer:1.10.17 bash -l -c \\"composer update --with-dependencies --ignore-platform-reqs --no-ansi --no-interaction --no-scripts --no-autoloader\\"",
+    "cmd": "docker run --rm --name=renovate_composer --label=renovate_child -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -v \\"/tmp/renovate/cache\\":\\"/tmp/renovate/cache\\" -e COMPOSER_CACHE_DIR -w \\"/tmp/github/some/repo\\" renovate/composer:1.10.17 bash -l -c \\"composer update --with-dependencies --ignore-platform-reqs --no-ansi --no-interaction --no-scripts --no-autoloader\\"",
     "options": Object {
       "cwd": "/tmp/github/some/repo",
       "encoding": "utf-8",
diff --git a/lib/manager/composer/artifacts.spec.ts b/lib/manager/composer/artifacts.spec.ts
index bdc0e9b35ead5f98093d592786f5cf4ba787c8e9..74dc9458f11764b31d63ba312de5e65e74f32612 100644
--- a/lib/manager/composer/artifacts.spec.ts
+++ b/lib/manager/composer/artifacts.spec.ts
@@ -28,7 +28,6 @@ const config = {
   // `join` fixes Windows CI
   localDir: join('/tmp/github/some/repo'),
   cacheDir: join('/tmp/renovate/cache'),
-  dockerUser: 'foobar',
   composerIgnorePlatformReqs: true,
 };
 
diff --git a/lib/manager/gomod/__snapshots__/artifacts.spec.ts.snap b/lib/manager/gomod/__snapshots__/artifacts.spec.ts.snap
index 0f45e7d37a7ffb47f0de0c070bea0b76b492a950..52bc2028753e457d8277f54bfe223448c8dd5ce0 100644
--- a/lib/manager/gomod/__snapshots__/artifacts.spec.ts.snap
+++ b/lib/manager/gomod/__snapshots__/artifacts.spec.ts.snap
@@ -84,7 +84,7 @@ Array [
     },
   },
   Object {
-    "cmd": "docker run --rm --name=renovate_go --label=renovate_child --user=foobar -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -v \\"/tmp/renovate/cache\\":\\"/tmp/renovate/cache\\" -v \\"/tmp/renovate/cache/others/go\\":\\"/tmp/renovate/cache/others/go\\" -e GOPATH -e GOPROXY -e GONOSUMDB -e CGO_ENABLED -w \\"/tmp/github/some/repo\\" renovate/go:latest bash -l -c \\"git config --global url.\\\\\\"https://some-token@github.com/\\\\\\".insteadOf \\\\\\"https://github.com/\\\\\\" && go get -d ./...\\"",
+    "cmd": "docker run --rm --name=renovate_go --label=renovate_child -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -v \\"/tmp/renovate/cache\\":\\"/tmp/renovate/cache\\" -v \\"/tmp/renovate/cache/others/go\\":\\"/tmp/renovate/cache/others/go\\" -e GOPATH -e GOPROXY -e GONOSUMDB -e CGO_ENABLED -w \\"/tmp/github/some/repo\\" renovate/go:latest bash -l -c \\"git config --global url.\\\\\\"https://some-token@github.com/\\\\\\".insteadOf \\\\\\"https://github.com/\\\\\\" && go get -d ./...\\"",
     "options": Object {
       "cwd": "/tmp/github/some/repo",
       "encoding": "utf-8",
@@ -123,7 +123,7 @@ Array [
     },
   },
   Object {
-    "cmd": "docker run --rm --name=renovate_go --label=renovate_child --user=foobar -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -v \\"/tmp/renovate/cache\\":\\"/tmp/renovate/cache\\" -v \\"/tmp/renovate/cache/others/go\\":\\"/tmp/renovate/cache/others/go\\" -e GOPATH -e GOPROXY -e GONOSUMDB -e CGO_ENABLED -w \\"/tmp/github/some/repo\\" renovate/go:latest bash -l -c \\"go get -d ./... && go mod tidy && go mod tidy\\"",
+    "cmd": "docker run --rm --name=renovate_go --label=renovate_child -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -v \\"/tmp/renovate/cache\\":\\"/tmp/renovate/cache\\" -v \\"/tmp/renovate/cache/others/go\\":\\"/tmp/renovate/cache/others/go\\" -e GOPATH -e GOPROXY -e GONOSUMDB -e CGO_ENABLED -w \\"/tmp/github/some/repo\\" renovate/go:latest bash -l -c \\"go get -d ./... && go mod tidy && go mod tidy\\"",
     "options": Object {
       "cwd": "/tmp/github/some/repo",
       "encoding": "utf-8",
@@ -162,7 +162,7 @@ Array [
     },
   },
   Object {
-    "cmd": "docker run --rm --name=renovate_go --label=renovate_child --user=foobar -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -v \\"/tmp/renovate/cache\\":\\"/tmp/renovate/cache\\" -v \\"/tmp/renovate/cache/others/go\\":\\"/tmp/renovate/cache/others/go\\" -e GOPATH -e GOPROXY -e GONOSUMDB -e CGO_ENABLED -w \\"/tmp/github/some/repo\\" renovate/go:latest bash -l -c \\"go get -d ./...\\"",
+    "cmd": "docker run --rm --name=renovate_go --label=renovate_child -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -v \\"/tmp/renovate/cache\\":\\"/tmp/renovate/cache\\" -v \\"/tmp/renovate/cache/others/go\\":\\"/tmp/renovate/cache/others/go\\" -e GOPATH -e GOPROXY -e GONOSUMDB -e CGO_ENABLED -w \\"/tmp/github/some/repo\\" renovate/go:latest bash -l -c \\"go get -d ./...\\"",
     "options": Object {
       "cwd": "/tmp/github/some/repo",
       "encoding": "utf-8",
diff --git a/lib/manager/gomod/artifacts.spec.ts b/lib/manager/gomod/artifacts.spec.ts
index f814c19e5313fa2355ae4819da3d0063ce26e2d3..783fd8d67e426662749682f6c982ed69fe75102c 100644
--- a/lib/manager/gomod/artifacts.spec.ts
+++ b/lib/manager/gomod/artifacts.spec.ts
@@ -39,7 +39,6 @@ const config = {
   // `join` fixes Windows CI
   localDir: join('/tmp/github/some/repo'),
   cacheDir: join('/tmp/renovate/cache'),
-  dockerUser: 'foobar',
   constraints: { go: '1.14' },
 };
 
diff --git a/lib/manager/helmv3/__snapshots__/artifacts.spec.ts.snap b/lib/manager/helmv3/__snapshots__/artifacts.spec.ts.snap
index da0ed762c322695c73821027ba202436be8f4989..0118cbd4b1b0ee2840cb528d38f64bc36dd60b40 100644
--- a/lib/manager/helmv3/__snapshots__/artifacts.spec.ts.snap
+++ b/lib/manager/helmv3/__snapshots__/artifacts.spec.ts.snap
@@ -95,7 +95,7 @@ Array [
     },
   },
   Object {
-    "cmd": "docker run --rm --name=renovate_helm --label=renovate_child --user=foobar -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -w \\"/tmp/github/some/repo\\" renovate/helm bash -l -c \\"helm dependency update ''\\"",
+    "cmd": "docker run --rm --name=renovate_helm --label=renovate_child -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -w \\"/tmp/github/some/repo\\" renovate/helm bash -l -c \\"helm dependency update ''\\"",
     "options": Object {
       "cwd": "/tmp/github/some/repo",
       "encoding": "utf-8",
diff --git a/lib/manager/helmv3/artifacts.spec.ts b/lib/manager/helmv3/artifacts.spec.ts
index 2ffaf1a698f519fdcdbdaa836238109c76d2c03a..506d17a6cdb4bae9527ed6dcbea15b76275b2c41 100644
--- a/lib/manager/helmv3/artifacts.spec.ts
+++ b/lib/manager/helmv3/artifacts.spec.ts
@@ -22,7 +22,6 @@ const env = mocked(_env);
 const config = {
   // `join` fixes Windows CI
   localDir: join('/tmp/github/some/repo'),
-  dockerUser: 'foobar',
 };
 
 describe('.updateArtifacts()', () => {
diff --git a/lib/manager/nuget/__snapshots__/artifacts.spec.ts.snap b/lib/manager/nuget/__snapshots__/artifacts.spec.ts.snap
index 8c3eec536f28ca8fafa4634f5af6d5424d01cb67..648131471c83dee79901bea61e566741e7f10d71 100644
--- a/lib/manager/nuget/__snapshots__/artifacts.spec.ts.snap
+++ b/lib/manager/nuget/__snapshots__/artifacts.spec.ts.snap
@@ -119,7 +119,7 @@ Array [
     },
   },
   Object {
-    "cmd": "docker run --rm --name=renovate_dotnet --label=renovate_child --user=foobar -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -v \\"/tmp/renovate/cache\\":\\"/tmp/renovate/cache\\" -w \\"/tmp/github/some/repo\\" renovate/dotnet bash -l -c \\"dotnet restore project.csproj --force-evaluate --configfile others/nuget/not-so-random/nuget.config\\"",
+    "cmd": "docker run --rm --name=renovate_dotnet --label=renovate_child -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -v \\"/tmp/renovate/cache\\":\\"/tmp/renovate/cache\\" -w \\"/tmp/github/some/repo\\" renovate/dotnet bash -l -c \\"dotnet restore project.csproj --force-evaluate --configfile others/nuget/not-so-random/nuget.config\\"",
     "options": Object {
       "cwd": "/tmp/github/some/repo",
       "encoding": "utf-8",
diff --git a/lib/manager/nuget/artifacts.spec.ts b/lib/manager/nuget/artifacts.spec.ts
index 90420ef8a744c865f1b83569a55b2c7cf0214dc8..549be8a5fdb909e1acb32dd84d3017d1bb40113a 100644
--- a/lib/manager/nuget/artifacts.spec.ts
+++ b/lib/manager/nuget/artifacts.spec.ts
@@ -37,7 +37,6 @@ const config = {
   // `join` fixes Windows CI
   localDir: join('/tmp/github/some/repo'),
   cacheDir: join('/tmp/renovate/cache'),
-  dockerUser: 'foobar',
 };
 
 describe('updateArtifacts', () => {
diff --git a/lib/manager/pipenv/__snapshots__/artifacts.spec.ts.snap b/lib/manager/pipenv/__snapshots__/artifacts.spec.ts.snap
index 0d02fad74710f0a7e9e34c3829d8645823b2c584..da8bb4d2db727632bb8a5bec9e399655eaf2bc3a 100644
--- a/lib/manager/pipenv/__snapshots__/artifacts.spec.ts.snap
+++ b/lib/manager/pipenv/__snapshots__/artifacts.spec.ts.snap
@@ -122,7 +122,7 @@ Array [
     },
   },
   Object {
-    "cmd": "docker run --rm --name=renovate_python --label=renovate_child --user=foobar -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -v \\"/tmp/renovate/cache\\":\\"/tmp/renovate/cache\\" -v \\"/tmp/renovate/cache/others/pipenv\\":\\"/tmp/renovate/cache/others/pipenv\\" -e PIPENV_CACHE_DIR -w \\"/tmp/github/some/repo\\" renovate/python:latest bash -l -c \\"pip install --user pipenv && pipenv lock\\"",
+    "cmd": "docker run --rm --name=renovate_python --label=renovate_child -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -v \\"/tmp/renovate/cache\\":\\"/tmp/renovate/cache\\" -v \\"/tmp/renovate/cache/others/pipenv\\":\\"/tmp/renovate/cache/others/pipenv\\" -e PIPENV_CACHE_DIR -w \\"/tmp/github/some/repo\\" renovate/python:latest bash -l -c \\"pip install --user pipenv && pipenv lock\\"",
     "options": Object {
       "cwd": "/tmp/github/some/repo",
       "encoding": "utf-8",
@@ -158,7 +158,7 @@ Array [
     },
   },
   Object {
-    "cmd": "docker run --rm --name=renovate_python --label=renovate_child --user=foobar -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -v \\"/tmp/renovate/cache\\":\\"/tmp/renovate/cache\\" -v \\"/tmp/renovate/cache/others/pipenv\\":\\"/tmp/renovate/cache/others/pipenv\\" -e PIPENV_CACHE_DIR -w \\"/tmp/github/some/repo\\" renovate/python bash -l -c \\"pip install --user pipenv==2020.8.13 && pipenv lock\\"",
+    "cmd": "docker run --rm --name=renovate_python --label=renovate_child -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -v \\"/tmp/renovate/cache\\":\\"/tmp/renovate/cache\\" -v \\"/tmp/renovate/cache/others/pipenv\\":\\"/tmp/renovate/cache/others/pipenv\\" -e PIPENV_CACHE_DIR -w \\"/tmp/github/some/repo\\" renovate/python bash -l -c \\"pip install --user pipenv==2020.8.13 && pipenv lock\\"",
     "options": Object {
       "cwd": "/tmp/github/some/repo",
       "encoding": "utf-8",
@@ -194,7 +194,7 @@ Array [
     },
   },
   Object {
-    "cmd": "docker run --rm --name=renovate_python --label=renovate_child --user=foobar -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -v \\"/tmp/renovate/cache\\":\\"/tmp/renovate/cache\\" -v \\"/tmp/renovate/cache/others/pipenv\\":\\"/tmp/renovate/cache/others/pipenv\\" -e PIPENV_CACHE_DIR -w \\"/tmp/github/some/repo\\" renovate/python bash -l -c \\"pip install --user pipenv==2020.8.13 && pipenv lock\\"",
+    "cmd": "docker run --rm --name=renovate_python --label=renovate_child -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -v \\"/tmp/renovate/cache\\":\\"/tmp/renovate/cache\\" -v \\"/tmp/renovate/cache/others/pipenv\\":\\"/tmp/renovate/cache/others/pipenv\\" -e PIPENV_CACHE_DIR -w \\"/tmp/github/some/repo\\" renovate/python bash -l -c \\"pip install --user pipenv==2020.8.13 && pipenv lock\\"",
     "options": Object {
       "cwd": "/tmp/github/some/repo",
       "encoding": "utf-8",
@@ -230,7 +230,7 @@ Array [
     },
   },
   Object {
-    "cmd": "docker run --rm --name=renovate_python --label=renovate_child --user=foobar -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -v \\"/tmp/renovate/cache\\":\\"/tmp/renovate/cache\\" -v \\"/tmp/renovate/cache/others/pipenv\\":\\"/tmp/renovate/cache/others/pipenv\\" -e PIPENV_CACHE_DIR -w \\"/tmp/github/some/repo\\" renovate/python bash -l -c \\"pip install --user pipenv==2020.1.1 && pipenv lock\\"",
+    "cmd": "docker run --rm --name=renovate_python --label=renovate_child -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -v \\"/tmp/renovate/cache\\":\\"/tmp/renovate/cache\\" -v \\"/tmp/renovate/cache/others/pipenv\\":\\"/tmp/renovate/cache/others/pipenv\\" -e PIPENV_CACHE_DIR -w \\"/tmp/github/some/repo\\" renovate/python bash -l -c \\"pip install --user pipenv==2020.1.1 && pipenv lock\\"",
     "options": Object {
       "cwd": "/tmp/github/some/repo",
       "encoding": "utf-8",
diff --git a/lib/manager/pipenv/artifacts.spec.ts b/lib/manager/pipenv/artifacts.spec.ts
index 4674adc1bb1eef9fc4602669c5914772d2aa48cd..165edc209b7e24050dccd124eb21bffdc6063d44 100644
--- a/lib/manager/pipenv/artifacts.spec.ts
+++ b/lib/manager/pipenv/artifacts.spec.ts
@@ -25,7 +25,6 @@ const config = {
   // `join` fixes Windows CI
   localDir: join('/tmp/github/some/repo'),
   cacheDir: join('/tmp/renovate/cache'),
-  dockerUser: 'foobar',
 };
 
 const dockerConfig = { ...config, binarySource: BinarySource.Docker };
diff --git a/lib/manager/poetry/__snapshots__/artifacts.spec.ts.snap b/lib/manager/poetry/__snapshots__/artifacts.spec.ts.snap
index 0996fcab4c94c5818677fadf2d4c80f233096e79..145316fedaef3f88adedcd33afe168c7e7fee276 100644
--- a/lib/manager/poetry/__snapshots__/artifacts.spec.ts.snap
+++ b/lib/manager/poetry/__snapshots__/artifacts.spec.ts.snap
@@ -100,7 +100,7 @@ Array [
     },
   },
   Object {
-    "cmd": "docker run --rm --name=renovate_python --label=renovate_child --user=foobar -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -w \\"/tmp/github/some/repo\\" renovate/python:2.7.5 bash -l -c \\"pip install 'poetry>=1.0' && poetry update --lock --no-interaction dep1\\"",
+    "cmd": "docker run --rm --name=renovate_python --label=renovate_child -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -w \\"/tmp/github/some/repo\\" renovate/python:2.7.5 bash -l -c \\"pip install 'poetry>=1.0' && poetry update --lock --no-interaction dep1\\"",
     "options": Object {
       "cwd": "/tmp/github/some/repo",
       "encoding": "utf-8",
@@ -135,7 +135,7 @@ Array [
     },
   },
   Object {
-    "cmd": "docker run --rm --name=renovate_python --label=renovate_child --user=foobar -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -w \\"/tmp/github/some/repo\\" renovate/python:3.4.2 bash -l -c \\"pip install poetry && poetry update --lock --no-interaction dep1\\"",
+    "cmd": "docker run --rm --name=renovate_python --label=renovate_child -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -w \\"/tmp/github/some/repo\\" renovate/python:3.4.2 bash -l -c \\"pip install poetry && poetry update --lock --no-interaction dep1\\"",
     "options": Object {
       "cwd": "/tmp/github/some/repo",
       "encoding": "utf-8",
diff --git a/lib/manager/poetry/artifacts.spec.ts b/lib/manager/poetry/artifacts.spec.ts
index 3ae83916dfec90437f7486ca589f59a64e6fe0ae..f08480e77135adf7d4dacbec52a9446c15b4eae0 100644
--- a/lib/manager/poetry/artifacts.spec.ts
+++ b/lib/manager/poetry/artifacts.spec.ts
@@ -135,7 +135,6 @@ describe('.updateArtifacts()', () => {
     await setExecConfig({
       ...config,
       binarySource: BinarySource.Docker,
-      dockerUser: 'foobar',
     });
     fs.readFile.mockResolvedValueOnce('[metadata]\n' as any);
     const execSnapshots = mockExecAll(exec);
@@ -162,7 +161,6 @@ describe('.updateArtifacts()', () => {
     await setExecConfig({
       ...config,
       binarySource: BinarySource.Docker,
-      dockerUser: 'foobar',
     });
     fs.readFile.mockResolvedValueOnce(
       '[metadata]\npython-versions = "~2.7 || ^3.4"' as any
diff --git a/lib/util/exec/common.ts b/lib/util/exec/common.ts
index 987fe5e081292fb3c4ab7da97c959c4f840fac6d..4564340eee3f33a97ac01192baef17073f99f5b4 100644
--- a/lib/util/exec/common.ts
+++ b/lib/util/exec/common.ts
@@ -14,8 +14,6 @@ export enum BinarySource {
 export interface ExecConfig {
   binarySource: Opt<BinarySource>;
   customEnvVariables: Opt<Record<string, string>>;
-  dockerImagePrefix: Opt<string>;
-  dockerUser: Opt<string>;
   localDir: Opt<string>;
   cacheDir: Opt<string>;
 }
diff --git a/lib/util/exec/docker/index.ts b/lib/util/exec/docker/index.ts
index b9f246412ee130e102e2b96de16273b76433ac9c..aae728ff6c1fc4c5aaa711731bd1be8191033458 100644
--- a/lib/util/exec/docker/index.ts
+++ b/lib/util/exec/docker/index.ts
@@ -1,3 +1,4 @@
+import { getAdminConfig } from '../../../config/admin';
 import { SYSTEM_INSUFFICIENT_MEMORY } from '../../../constants/error-messages';
 import { getPkgReleases } from '../../../datasource';
 import { logger } from '../../../logger';
@@ -186,8 +187,8 @@ export async function generateDockerCommand(
   const volumes = options.volumes || [];
   const preCommands = options.preCommands || [];
   const postCommands = options.postCommands || [];
-  const { localDir, cacheDir, dockerUser } = config;
-
+  const { localDir, cacheDir } = config;
+  const { dockerUser, dockerImagePrefix } = getAdminConfig();
   const result = ['docker run --rm'];
   const containerName = getContainerName(image);
   result.push(`--name=${containerName}`);
@@ -210,10 +211,10 @@ export async function generateDockerCommand(
     result.push(`-w "${cwd}"`);
   }
 
-  if (config.dockerImagePrefix) {
+  if (dockerImagePrefix) {
     image = image.replace(
       /^renovate\//,
-      ensureTrailingSlash(config.dockerImagePrefix)
+      ensureTrailingSlash(dockerImagePrefix)
     );
   }
 
diff --git a/lib/util/exec/exec.spec.ts b/lib/util/exec/exec.spec.ts
index c83246fa624dca42bcd76cf7c796b04cafbdf88f..c118e5cf1f167a780d07a8dc420a6413d585c668 100644
--- a/lib/util/exec/exec.spec.ts
+++ b/lib/util/exec/exec.spec.ts
@@ -4,6 +4,8 @@ import {
   exec as _cpExec,
 } from 'child_process';
 import { envMock } from '../../../test/exec-util';
+import { setAdminConfig } from '../../config/admin';
+import { RepoAdminConfig } from '../../config/common';
 import {
   BinarySource,
   ExecConfig,
@@ -25,6 +27,7 @@ interface TestInput {
   outCmd: string[];
   outOpts: RawExecOptions[];
   trustLevel?: 'high' | 'low';
+  adminConfig?: RepoAdminConfig;
 }
 
 describe(`Child process execution wrapper`, () => {
@@ -390,7 +393,6 @@ describe(`Child process execution wrapper`, () => {
         execConfig: {
           ...execConfig,
           binarySource: BinarySource.Docker,
-          dockerUser: 'foobar',
         },
         processEnv,
         inCmd,
@@ -411,6 +413,7 @@ describe(`Child process execution wrapper`, () => {
             maxBuffer: 10485760,
           },
         ],
+        adminConfig: { dockerUser: 'foobar' },
       },
     ],
 
@@ -420,7 +423,6 @@ describe(`Child process execution wrapper`, () => {
         execConfig: {
           ...execConfig,
           binarySource: BinarySource.Docker,
-          dockerImagePrefix: 'ghcr.io/renovatebot',
         },
         processEnv,
         inCmd,
@@ -441,6 +443,7 @@ describe(`Child process execution wrapper`, () => {
             maxBuffer: 10485760,
           },
         ],
+        adminConfig: { dockerImagePrefix: 'ghcr.io/renovatebot' },
       },
     ],
 
@@ -660,6 +663,7 @@ describe(`Child process execution wrapper`, () => {
       outCmd: outCommand,
       outOpts,
       trustLevel,
+      adminConfig = {},
     } = testOpts;
 
     process.env = procEnv;
@@ -682,7 +686,7 @@ describe(`Child process execution wrapper`, () => {
       callback(null, { stdout: '', stderr: '' });
       return undefined;
     });
-
+    setAdminConfig(adminConfig as any, Object.keys(adminConfig));
     await exec(cmd as string, inOpts);
 
     expect(actualCmd).toEqual(outCommand);
diff --git a/lib/util/exec/index.ts b/lib/util/exec/index.ts
index 1ede34ce6353d70a43b25b7a150ac00c145b3787..fc9d7e984f759b5cc9bcf5f690c303cd4976d7f1 100644
--- a/lib/util/exec/index.ts
+++ b/lib/util/exec/index.ts
@@ -21,8 +21,6 @@ import { getChildProcessEnv } from './env';
 const execConfig: ExecConfig = {
   binarySource: null,
   customEnvVariables: null,
-  dockerImagePrefix: null,
-  dockerUser: null,
   localDir: null,
   cacheDir: null,
 };
diff --git a/lib/util/template/index.ts b/lib/util/template/index.ts
index 612b9f279cccc493f1bd46bd970615f9f382759b..d48b980ea3c80840bbf0b09c91495e92511b0855 100644
--- a/lib/util/template/index.ts
+++ b/lib/util/template/index.ts
@@ -1,5 +1,6 @@
 import is from '@sindresorhus/is';
 import * as handlebars from 'handlebars';
+import { getAdminConfig } from '../../config/admin';
 import { logger } from '../../logger';
 import { clone } from '../clone';
 
@@ -144,7 +145,8 @@ export function compile(
   input: CompileInput,
   filterFields = true
 ): string {
-  const filteredInput = filterFields ? getFilteredObject(input) : input;
+  const data = { ...getAdminConfig(), ...input };
+  const filteredInput = filterFields ? getFilteredObject(data) : data;
   logger.trace({ template, filteredInput }, 'Compiling template');
   if (filterFields) {
     const matches = template.matchAll(templateRegex);
diff --git a/lib/workers/global/index.ts b/lib/workers/global/index.ts
index 45357d5086effe636294fac4424f1cb427f41414..2bbea30c1e2de760ddf0f608e1c66f9a5d448c2e 100644
--- a/lib/workers/global/index.ts
+++ b/lib/workers/global/index.ts
@@ -3,6 +3,8 @@ import { ERROR } from 'bunyan';
 import fs from 'fs-extra';
 import upath from 'upath';
 import * as configParser from '../../config';
+import { setAdminConfig } from '../../config/admin';
+import { getAdminOptionNames } from '../../config/definitions';
 import { getProblems, logger, setMeta } from '../../logger';
 import { setUtilConfig } from '../../util';
 import * as hostRules from '../../util/host-rules';
@@ -58,6 +60,7 @@ export async function start(): Promise<number> {
         break;
       }
       const repoConfig = await getRepositoryConfig(config, repository);
+      setAdminConfig(repoConfig, getAdminOptionNames());
       await setUtilConfig(repoConfig);
       if (repoConfig.hostRules) {
         hostRules.clear();