Steps to enable TLS in Docker for secure configuration
|
Preface I had previously enabled Docker's 2375 Remote API. I received a request from the company's security department that I need to enable authorization. I looked up the official documentation. Protect the Docker daemon socket Enable TLS On the docker server, generate CA private and public keys $ openssl genrsa -aes256 -out ca-key.pem 4096 Generating RSA private key, 4096 bit long modulus ............................................................................................................................................................................................................++ ........++ e is 65537 (0x10001) Enter pass phrase for ca-key.pem: Verifying - Enter pass phrase for ca-key.pem: $ openssl req -new -x509 -days 365 -key ca-key.pem -sha256 -out ca.pem Enter pass phrase for ca-key.pem: You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]: State or Province Name (full name) [Some-State]:Queensland Locality Name (eg, city) []:Brisbane Organization Name (eg, company) [Internet Widgits Pty Ltd]:Docker Inc Organizational Unit Name (eg, section) []:Sales Common Name (eg server FQDN or YOUR name) []:$HOST Email Address []:[email protected] Once you have a CA, you can create a server key and certificate signing request (CSR)
$ openssl genrsa -out server-key.pem 4096 Generating RSA private key, 4096 bit long modulus .....................................................................................++ .................................................................................................................++ e is 65537 (0x10001) $ openssl req -subj "/CN=$HOST" -sha256 -new -key server-key.pem -out server.csr Next, use the CA to sign the public key: $ echo subjectAltName = DNS:$HOST,IP:$HOST:127.0.0.1 >> extfile.cnf $ echo extendedKeyUsage = serverAuth >> extfile.cnf Generate key: $ openssl x509 -req -days 365 -sha256 -in server.csr -CA ca.pem -CAkey ca-key.pem \ -CAcreateserial -out server-cert.pem -extfile extfile.cnf Signature ok subject=/CN=your.host.com Getting CA Private Key Enter pass phrase for ca-key.pem: Create the client key and certificate signing request: $ openssl genrsa -out key.pem 4096 Generating RSA private key, 4096 bit long modulus .........................................................++ ................++ e is 65537 (0x10001) $ openssl req -subj '/CN=client' -new -key key.pem -out client.csr Modify extfile.cnf: echo extendedKeyUsage = clientAuth > extfile-client.cnf Generate a signing private key: $ openssl x509 -req -days 365 -sha256 -in client.csr -CA ca.pem -CAkey ca-key.pem \ -CAcreateserial -out cert.pem -extfile extfile-client.cnf Signature ok subject=/CN=client Getting CA Private Key Enter pass phrase for ca-key.pem: Stop the Docker service and modify the Docker service file [Unit] Description=Docker Application Container Engine Documentation=http://docs.docker.io [Service] Environment="PATH=/opt/kube/bin:/bin:/sbin:/usr/bin:/usr/sbin" ExecStart=/opt/kube/bin/dockerd --tlsverify --tlscacert=/root/docker/ca.pem --tlscert=/root/docker/server-cert.pem --tlskey=/root/docker/server-key.pem -H unix:///var/run/docker.sock -H tcp://0.0.0.0:2375 ExecStartPost=/sbin/iptables -I FORWARD -s 0.0.0.0/0 -j ACCEPT ExecReload=/bin/kill -s HUP $MAINPID Restart=on-failure RestartSec=5 LimitNOFILE=infinity LimitNPROC=infinity LimitCORE=infinity Delegate=yes KillMode=process [Install] WantedBy=multi-user.target Then restart the service systemctl daemon-reload systemctl restart docker.service Check the service status after restart: systemctl status docker.service ● docker.service - Docker Application Container Engine Loaded: loaded (/etc/systemd/system/docker.service; enabled; vendor preset: enabled) Active: active (running) since Thu 2019-08-08 19:22:26 CST; 1 min ago Already in effect. Connect using a certificate: Copy the three files ca.pem, cert.pem, and key.pem to the client docker --tlsverify --tlscacert=ca.pem --tlscert=cert.pem --tlskey=key.pem -H=$HOST:2375 version can be connected docker-java enable TLS The project uses docker's java client docker-java to call docker. In order to support TLS, you need to add TLS settings when creating the client. First, copy the three files ca.pem cert.pem key.pem to a local location, for example, E:\\docker\\", Then set withDockerTlsVerify to true in DefaultDockerClientConfig and set certpath to the directory just copied.
DefaultDockerClientConfig.Builder builder =
DefaultDockerClientConfig.createDefaultConfigBuilder()
.withDockerHost("tcp://" + server + ":2375")
.withApiVersion("1.30");
if (containerConfiguration.getDockerTlsVerify()) {
builder = builder.withDockerTlsVerify(true)
.withDockerCertPath("E:\\docker\\");
}
return DockerClientBuilder.getInstance(builder.build()).build()The big job is done. Summarize The above is the full content of this article. I hope that the content of this article will have certain reference learning value for your study or work. Thank you for your support of 123WORDPRESS.COM. You may also be interested in:
|
<<: A brief introduction to React
>>: Mysql specifies the date range extraction method
Recommend
Introduction to deploying selenium crawler program under Linux system
Table of contents Preface 1. What is selenium? 2....
Solution to the problem that the InnoDB engine is disabled when MySQL is started
Find the problem Today at work, when copying tabl...
Simple summary of tomcat performance optimization methods
Tomcat itself optimization Tomcat Memory Optimiza...
How to write the parent and child directories of HTML relative paths
How to indicate the parent directory ../ represent...
Solutions to MySQL batch insert and unique index problems
MySQL batch insert problem When developing a proj...
MySQL query optimization: causes and solutions for slow queries
Friends who are doing development, especially tho...
Detailed explanation of prototypes and prototype chains in JavaScript
Table of contents Prototype chain diagram Essenti...
The complete process of Docker image creation
Table of contents Preface Creation steps Create a...
How to use the Fuser command in Linux system
What is Fuser Command? The fuser command is a ver...
A more elegant error handling method in JavaScript async await
Table of contents background Why error handling? ...
Docker container connection implementation steps analysis
Generally speaking, after the container is starte...
Interpretation of CocosCreator source code: engine startup and main loop
Table of contents Preface preparation Go! text St...
The docker prune command can be used to periodically clean up infrequently used data
Table of contents docker system df docker system ...
A brief analysis of the problem of mysql being inaccessible when deployed with docker-compose
What is Docker-Compose The Compose project origin...
The principle and basic use of Vue.use() in Vue
Table of contents Preface 1. Understanding with e...