Docker Engine -> User guide -> Secure Engine -> Protect the Docker daemon socket

Protect the Docker daemon socket

默認的，Docker的運行通過non-networked Unix socket.當(dāng)然也可以通過HTTP socket進行通信。

如果你需要一種安全的網(wǎng)絡(luò)方式，你可以開啟TLS通過指定tlsverify標識并指明Docker的證書位置通過tlscacert標識去信任一個CA證書。

在daemon的模式下，將只會允許擁有CA簽名的證書的認證客戶端去鏈接。在client模式下，將通過這個CA簽名的證書連接到服務(wù)器。

警告 ：使用TLS并管理CA是高級部分。請在生產(chǎn)環(huán)境使用之前熟悉OpenSSL，x509 ，和TLS。

警告 ：這里的TLS命令在Linux下只會生成一個證書的工作集，Mac OS X的一些版本的OpenSSL與Docker需要的證書不兼容。

Create a CA, server and client key with OpenSSL

注意：替換下命例子中的$HOST和DNS名為你的Docker daemon的主機。

首先生成CA的私鑰和公鑰:

# ------------------生成CA私鑰 ca-key.pem-----------------
$ openssl genrsa -aes256 -out ca-key.pem 4096
Generating RSA private key, 4096 bit long modulus
............................................................................................................................................................................................++
........++
e is 65537 (0x10001)
Enter pass phrase for ca-key.pem:
Verifying - Enter pass phrase for ca-key.pem:

# ------------------生成CA公鑰 ca.pem-----------------------
$ openssl req -new -x509 -days 365 -key ca-key.pem -sha256 -out ca.pem
Enter pass phrase for ca-key.pem:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:Queensland
Locality Name (eg, city) []:Brisbane
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Docker Inc
Organizational Unit Name (eg, section) []:Sales
#Common Name 在這里 ?。。。。。。。?！
Common Name (e.g. server FQDN or YOUR name) []:$HOST
Email Address []:Sven@home.org.au

現(xiàn)在我們已經(jīng)有了一個CA，可以創(chuàng)建一個server key和certifivate signing request(CSR).確?！癈ommon Name”與你要連接的Docker的hostname匹配:

注意：替換下命例子中的$HOST和DNS名為你的Docker daemon的主機。

$ openssl genrsa -out server-key.pem 4096
Generating RSA private key, 4096 bit long modulus
.....................................................................++
.................................................................................................++
e is 65537 (0x10001)
$ openssl req -subj "/CN=$HOST" -sha256 -new -key server-key.pem -out server.csr

接下來，我們可以...