开启docker remote api 并添加证书

配置证书（网上找到一个好用的脚本，直接梭哈）

#!/bin/sh

export PASSWORD="123123"
export COUNTRY="CN"
export STATE="xxx"
export CITY="xxx"
export ORGANIZATION="xxx"
export ORGANIZATIONAL_UNIT="bugku"
export COMMON_NAME="aman.docker"
export EMAIL="61898864@qq.com"

export HOST_NAME="$COMMON_NAME"
export IP="x.x.x.x"

export DIR="/etc/docker"
cd $DIR

# Generate CA

openssl genrsa -aes256 -passout "pass:$PASSWORD" -out "$DIR/ca-key.pem" 4096

openssl req -new -x509 -days 3650 -key "$DIR/ca-key.pem" -sha256 -out "$DIR/ca.pem" -passin "pass:$PASSWORD" -subj "/C=$COUNTRY/ST=$STATE/L=$CITY/O=$ORGANIZATION/OU=$ORGANIZATIONAL_UNIT/CN=$COMMON_NAME/emailAddress=$EMAIL"

# Generate Server Certs

openssl genrsa -out "$DIR/server-key.pem" 4096

openssl req -subj "/CN=$HOST_NAME" -sha256 -new -key "$DIR/server-key.pem" -out $DIR/server.csr

echo "subjectAltName = DNS:$HOST_NAME,IP:$IP,IP:0.0.0.0" > $DIR/server.cnf
echo "extendedKeyUsage = serverAuth" >> $DIR/server.cnf

openssl x509 -req -days 3650 -sha256 -in $DIR/server.csr -passin "pass:$PASSWORD" -CA "$DIR/ca.pem" -CAkey "$DIR/ca-key.pem" -CAcreateserial -out "$DIR/server-cert.pem" -extfile $DIR/server.cnf

# Generate Client Certs

openssl genrsa -out "$DIR/client-key.pem" 4096

openssl req -subj '/CN=client' -new -key "$DIR/client-key.pem" -out $DIR/client.csr

echo "extendedKeyUsage = clientAuth" > $DIR/client.cnf

openssl x509 -req -days 3650 -sha256 -in $DIR/client.csr -passin "pass:$PASSWORD" -CA "$DIR/ca.pem" -CAkey "$DIR/ca-key.pem" -CAcreateserial -out "$DIR/client-cert.pem" -extfile $DIR/client.cnf

# Modify Certs Permission

chmod 0400 $DIR/*-key.pem
chmod 0444 $DIR/ca.pem $DIR/*-cert.pem

# Remove Temporary Files

rm -f $DIR/*.csr $DIR/*.cnf

修改Docker配置文件

#找到/lib/systemd/system/docker.service中的这一行，改为
ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock
#后面加上如下参数
ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --tlsverify \
    --tlscacert=/etc/docker/ca.pem \
    --tlscert=/etc/docker/server-cert.pem \
    --tlskey=/etc/docker/server-key.pem \
    -H tcp://0.0.0.0:2376

重启Doker

systemctl daemon-reload && systemctl restart docker

验证

docker --tlsverify --tlscacert=/etc/docker/ca.pem  --tlscert=/etc/docker/client-cert.pem --tlskey=/etc/docker/client-key.pem  -H x.x.x.x:2376 version

指尖上的旋律 - Aman`s blog

Aman