Detailed example of remotely connecting to Docker using TLS encrypted communication

Detailed example of remotely connecting to Docker using TLS encrypted communication

By default, Docker runs over a non-networked UNIX socket. It can also use HTTP sockets for optional communication.
If you need to access Docker over the network in a secure manner, you can enable TLS by specifying the Docker flag to point to a trusted CA certificate.
In daemon mode, it only allows connections from clients that are authenticated by a certificate signed by this CA. In client mode, it only connects to servers that have a certificate signed by that CA.

# Create CA certificate directory [root@localhost ~]# mkdir tls
[root@localhost ~]# cd tls/
# Create CA key [root@localhost tls]# openssl genrsa -aes256 -out ca-key.pem 4096
Generating RSA private key, 4096 bit long modulus
..............................................................................++
.....................................................................................................................................................................................++
e is 65537 (0x10001)
Enter pass phrase for ca-key.pem:
Verifying - Enter pass phrase for ca-key.pem:
# Create CA certificate [root@localhost tls]# openssl req -new -x509 -days 1000 -key ca-key.pem -sha256 -subj "/CN=*" -out ca.pem
Enter pass phrase for ca-key.pem:
[root@localhost tls]# ll
Total dosage 8
-rw-r--r--. 1 root root 3326 12月3 17:20 ca-key.pem
-rw-r--r--. 1 root root 1765 Dec 3 19:03 ca.pem
# Create server private key [root@localhost tls]# openssl genrsa -out server-key.pem 4096
Generating RSA private key, 4096 bit long modulus
................................................................++
..................++
e is 65537 (0x10001)
[root@localhost tls]# ll
Total dosage 12
-rw-r--r--. 1 root root 3326 12月3 17:20 ca-key.pem
-rw-r--r--. 1 root root 1765 Dec 3 19:03 ca.pem
-rw-r--r--. 1 root root 3243 12月3 19:03 server-key.pem
# Sign the private key [root@localhost tls]# openssl req -subj "/CN=*" -sha256 -new -key server-key.pem -out server.csr
[root@localhost tls]# ll
Total dosage 16
-rw-r--r--. 1 root root 3326 12月3 17:20 ca-key.pem
-rw-r--r--. 1 root root 1765 Dec 3 19:03 ca.pem
-rw-r--r--. 1 root root 1574 12月3 19:04 server.csr
-rw-r--r--. 1 root root 3243 12月3 19:03 server-key.pem
Sign with CA certificate and private key, enter the password set above [root@localhost tls]# openssl x509 -req -days 1000 -sha256 -in server.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out server-cert.pem
Signature ok
subject=/CN=*
Getting CA Private Key
Enter pass phrase for ca-key.pem:
#Generate client key [root@localhost tls]# openssl genrsa -out key.pem 4096
Generating RSA private key, 4096 bit long modulus
....................................................................................................................................++
.................................++
e is 65537 (0x10001)
#Sign the client [root@localhost tls]# openssl req -subj "/CN=client" -new -key key.pem -out client.csr
#Create configuration file [root@localhost tls]# echo extendedKeyUsage=clientAuth > extfile.cnf
#Sign certificate [root@localhost tls]# openssl x509 -req -days 1000 -sha256 -in client.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out cert.pem -extfile extfile.cnf
Signature ok
subject=/CN=client
Getting CA Private Key
Enter pass phrase for ca-key.pem:
[root@localhost tls]# ll
Total dosage 40
-rw-r--r--. 1 root root 3326 12月3 17:20 ca-key.pem
-rw-r--r--. 1 root root 1765 Dec 3 19:03 ca.pem
-rw-r--r--. 1 root root 17 December 3 19:35 ca.srl
-rw-r--r--. 1 root root 1696 Dec 3 19:35 cert.pem
-rw-r--r--. 1 root root 1582 December 3 19:29 client.csr
-rw-r--r--. 1 root root 28 12月3 19:32 extfile.cnf
-rw-r--r--. 1 root root 3243 December 3 19:08 key.pem
-rw-r--r--. 1 root root 1647 Dec 3 19:08 server-cert.pem
-rw-r--r--. 1 root root 1574 12月3 19:04 server.csr
-rw-r--r--. 1 root root 3243 12月3 19:03 server-key.pem
# Delete unnecessary files [root@localhost tls]#

Testing on the client

[root@client ~]# docker --tlsverify --tlscacert=ca.pem --tlscert=cert.pem --tlskey=key.pem -H tcp://master:2376 version
Client: Docker Engine - Community
 Version: 19.03.13
 API version: 1.40
 Go version: go1.13.15
 Git commit: 4484c46d9d
 Built: Wed Sep 16 17:03:45 2020
 OS/Arch: linux/amd64
 Experimental: false

Server: Docker Engine - Community
 Engine:
 Version: 19.03.13
 API version: 1.40 (minimum version 1.12)
 Go version: go1.13.15
 Git commit: 4484c46d9d
 Built: Wed Sep 16 17:02:21 2020
 OS/Arch: linux/amd64
 Experimental: false
 containerd:
 Version: 1.3.9
 GitCommit: ea765aba0d05254012b0b9e595e995c09186427f
 runc:
 Version: 1.0.0-rc10
 GitCommit: dc9208a3303feef5b3839f4323d9beb36df0a9dd
 docker-init:
 Version: 0.18.0
 GitCommit: fec3683

This concludes this article about using TLS encrypted communication to remotely connect to Docker. For more information about TLS encrypted remote connection to Docker, please search for previous articles on 123WORDPRESS.COM or continue to browse the following related articles. I hope you will support 123WORDPRESS.COM in the future!

You may also be interested in:
  • Docker enables secure TLS remote connection access
  • How to set up vscode remote connection to server docker container
  • Docker deploys mysql remote connection to solve 2003 problems
  • Tutorial on installing MySQL with Docker and implementing remote connection
  • Docker deploys mysql to achieve remote connection sample code
  • Detailed explanation of docker daemon remote connection settings
  • Implementation example of Docker remote connection settings

<<:  HTML table tag tutorial (26): cell tag

>>:  How to forget the root password in Mysql8.0.13 under Windows 10 system

Blog    

Recommend

Web designers should optimize web pages from three aspects

<br />With the increase of bandwidth, there ...

Vue detailed explanation of mixins usage

Table of contents Preface 1. What are Mixins? 2. ...

uniapp project optimization methods and suggestions

Table of contents 1. Encapsulate complex page dat...

Mini Program Recording Function Implementation

Preface In the process of developing a mini progr...

How to install the green version of MySQL Community Server 5.7.16 and implement remote login

1. Download MySQL Community Server 5.7.16 and ins...

Implementation steps for building FastDFS file server in Linux

Table of contents 1. Software Package 2. Install ...

Simple example of limit parameter of mysql paging

Two parameters of Mysql paging select * from user...

Linux uses join -a1 to merge two files

To merge the following two files, merge them toge...

The unreasonable MaxIdleConns of MySQL will cause short connections

1 Background Recently, some performance issues ha...

Problems and solutions for deploying Nginx+KeepAlived cluster dual-active architecture in VMware

Preface Use nginx for load balancing. As the fron...

JavaScript implements countdown on front-end web page

Use native JavaScript to simply implement the cou...

Limiting the number of short-term accesses to a certain IP based on Nginx

How to set a limit on the number of visits to a c...

Steps to install cuda10.1 on Ubuntu 20.04 (graphic tutorial)

Pre-installation preparation The main purpose of ...

A brief discussion on the differences between several ways of executing .sh files in Ubuntu

Preface Different script execution methods will r...

mysql-8.0.16 winx64 latest installation tutorial with pictures and text

I just started learning about databases recently....