Docker Securtiy¶

Securing Docker Host¶

1. Enabling SSH-Key Based Authentication
2. Enabling firewall

Enabling encrypted access to Docker Host using API¶

On Docker Host (Server Side)¶

sudo vim /etc/docker/daemon.json

{
    "hosts": ["tcp://192.168.1.10:2376"],
    "tls": true,
    "tlscert": "/var/docker/server.pem",
    "tlskey": "/var/docker/serverkey.pem"
}

On Docker CLI (Client Side)¶

export DOCKER_TLS=true
export DOCKER_HOST="tcp://192.168.1.10:2376"

or while running docker command

docker --tls --host=tcp://192.168.1.10:2376 ps

Enabling authentication on Docker Host¶

On Docker Host (Server Side)¶

sudo vim /etc/docker/daemon.json

{
    "hosts": ["tcp://192.168.1.10:2376"],
    "tls": true,
    "tlscert": "/var/docker/server.pem",
    "tlskey": "/var/docker/serverkey.pem",
    "tlsverify": true,
    "tlscacert": "/var/docker/caserver.pem"
}

On Docker CLI (Client Side)¶

Generate client.pem clientkey.pem and cacert.pem

On Docker CLI (Client Side)¶

export DOCKER_TLS_VERIFY=true
export DOCKER_HOST="tcp://192.168.1.10:2376"

or using docker command pass --tlscert --tlskey and --tlscacert

docker --tlscert=<> --tlskey=<> --tlscacert=<> ps