Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ssl docker daemon connection #308

Open
vandman opened this issue Jun 18, 2024 · 7 comments
Open

ssl docker daemon connection #308

vandman opened this issue Jun 18, 2024 · 7 comments
Labels
daemon docker Docker Engine API

Comments

@vandman
Copy link

vandman commented Jun 18, 2024

Describe why it is important and where it will be useful

  • I do not know if it is me, but I do not see any option to load certificate to be able to use ssl to connect to the docker daemon. In my case, when I activate ssl, It does not work as I use self signed certificate. I guess In most company, This is the case.
  • with https, network must no be set specifically to host.

Describe your proposed solution

Add options to be able to load certificate from file system.
to be clear, you could use the same key as in daemon.json in /etc/docker/
"tlscacert", "tlscert", "tlskey".

Describe alternatives you've considered, if relevant

No response

Additional context

No response

@bigcat88
Copy link
Member

Please use occ security:certificates:import for that

@vandman
Copy link
Author

vandman commented Jun 18, 2024

Hi,
Thanks for your answer, but unfortunately, it does not solve the problem.
If you secure your docker daemon with self signed certificate, it means that app_api will be the client. So the client need a private key to encrypt data. In order to trust this key, you also need to provide the root CA public key.
The private key can not be loaded by occ security:certificates:import, moreover, how do you select the proper client certificate to start communicating in ssl?

You need to specify the certificate files.

Look at the Docker documentation

regards

@vandman
Copy link
Author

vandman commented Jun 20, 2024

Hi,
I am not sure, but it might be wrong because the container has acces to the docker socket.
Try the same thing without the -v /var/run/docker.sock:/var/run/docker.sock parameter.

There is difference between my setting and the test, my docker server has a private/public key, each of my service that need to comunicate with the daemon has its own private/public key.
The service/container that need to comunicate with docker daemon are not launched with --net host, I set up specific authorisation to allow trafic from container to the host.
Regards
Pierre

@bigcat88
Copy link
Member

I am not sure, but it might be wrong because the container has acces to the docker socket.

docker-socket-proxy must have access to the "/var/run/docker.sock" , it's goal is to allow accessing docker socket for AppAPI with the network requests.

@vandman
Copy link
Author

vandman commented Jun 22, 2024

Hi,
By docker-socket-proxy, do you mean this repository https://github.com/Tecnativa/docker-socket-proxy.
If yes, that mean that I need to install docker-socket-proxy too to make AppApi work, Am I right?

@andrey18106
Copy link
Collaborator

Hi, By docker-socket-proxy, do you mean this repository https://github.com/Tecnativa/docker-socket-proxy.

Hi!

By docker-socket-proxy we mean our implementation, which is based on haproxy alpine, configuration is originally like in all-in-one config, with a few security adjustments for remote installs.

If yes, that mean that I need to install docker-socket-proxy too to make AppApi work, Am I right?

As was said above, yes, AppAPI requires the Docker daemon configured to work with it via network requests.
Please follow our instructions in docker-socket-proxy to setup https docker socket proxy connection.

If you have any further questions, do not hesitate to ask them here.

@andrey18106 andrey18106 added daemon docker Docker Engine API labels Jul 2, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
daemon docker Docker Engine API
Projects
None yet
Development

No branches or pull requests

3 participants