Skip to content

Docker Securtiy

Securing Docker Host

  1. Enabling SSH-Key Based Authentication
  2. Enabling firewall

Enabling encrypted access to Docker Host using API

On Docker Host (Server Side)

sudo vim /etc/docker/daemon.json

{
    "hosts": ["tcp://192.168.1.10:2376"],
    "tls": true,
    "tlscert": "/var/docker/server.pem",
    "tlskey": "/var/docker/serverkey.pem"
}

On Docker CLI (Client Side)

export DOCKER_TLS=true
export DOCKER_HOST="tcp://192.168.1.10:2376"

or while running docker command

docker --tls --host=tcp://192.168.1.10:2376 ps

Enabling authentication on Docker Host

On Docker Host (Server Side)

sudo vim /etc/docker/daemon.json

{
    "hosts": ["tcp://192.168.1.10:2376"],
    "tls": true,
    "tlscert": "/var/docker/server.pem",
    "tlskey": "/var/docker/serverkey.pem",
    "tlsverify": true,
    "tlscacert": "/var/docker/caserver.pem"
}

On Docker CLI (Client Side)

Generate client.pem clientkey.pem and cacert.pem

On Docker CLI (Client Side)

export DOCKER_TLS_VERIFY=true
export DOCKER_HOST="tcp://192.168.1.10:2376"

or using docker command pass --tlscert --tlskey and --tlscacert

docker --tlscert=<> --tlskey=<> --tlscacert=<> ps