2017-06-01 20:34:31 +00:00
|
|
|
package main
|
2015-05-05 04:18:28 +00:00
|
|
|
|
|
|
|
import (
|
|
|
|
"os"
|
|
|
|
"path/filepath"
|
|
|
|
|
2017-06-01 20:34:31 +00:00
|
|
|
cliconfig "github.com/docker/docker/cli/config"
|
|
|
|
"github.com/docker/docker/daemon/config"
|
2015-05-05 04:18:28 +00:00
|
|
|
"github.com/docker/docker/opts"
|
2015-12-30 00:27:12 +00:00
|
|
|
"github.com/docker/go-connections/tlsconfig"
|
2016-06-21 20:42:47 +00:00
|
|
|
"github.com/spf13/pflag"
|
2015-05-05 04:18:28 +00:00
|
|
|
)
|
|
|
|
|
|
|
|
const (
|
2016-02-19 22:42:51 +00:00
|
|
|
// DefaultCaFile is the default filename for the CA pem file
|
|
|
|
DefaultCaFile = "ca.pem"
|
|
|
|
// DefaultKeyFile is the default filename for the key pem file
|
|
|
|
DefaultKeyFile = "key.pem"
|
|
|
|
// DefaultCertFile is the default filename for the cert pem file
|
|
|
|
DefaultCertFile = "cert.pem"
|
2016-12-20 11:14:41 +00:00
|
|
|
// FlagTLSVerify is the flag name for the TLS verification option
|
2016-06-21 20:42:47 +00:00
|
|
|
FlagTLSVerify = "tlsverify"
|
2020-07-28 23:01:08 +00:00
|
|
|
// FlagTLS is the flag name for the TLS option
|
|
|
|
FlagTLS = "tls"
|
|
|
|
// DefaultTLSValue is the default value used for setting the tls option for tcp connections
|
|
|
|
DefaultTLSValue = false
|
2015-05-05 04:18:28 +00:00
|
|
|
)
|
|
|
|
|
|
|
|
var (
|
|
|
|
dockerCertPath = os.Getenv("DOCKER_CERT_PATH")
|
|
|
|
dockerTLSVerify = os.Getenv("DOCKER_TLS_VERIFY") != ""
|
|
|
|
)
|
|
|
|
|
2017-06-01 20:34:31 +00:00
|
|
|
type daemonOptions struct {
|
|
|
|
configFile string
|
|
|
|
daemonConfig *config.Config
|
|
|
|
flags *pflag.FlagSet
|
|
|
|
Debug bool
|
|
|
|
Hosts []string
|
|
|
|
LogLevel string
|
|
|
|
TLS bool
|
|
|
|
TLSVerify bool
|
|
|
|
TLSOptions *tlsconfig.Options
|
2018-11-05 00:52:26 +00:00
|
|
|
Validate bool
|
2016-04-21 21:51:28 +00:00
|
|
|
}
|
|
|
|
|
2017-06-01 20:34:31 +00:00
|
|
|
// newDaemonOptions returns a new daemonFlags
|
|
|
|
func newDaemonOptions(config *config.Config) *daemonOptions {
|
|
|
|
return &daemonOptions{
|
|
|
|
daemonConfig: config,
|
|
|
|
}
|
2016-06-21 20:42:47 +00:00
|
|
|
}
|
2016-02-19 22:42:51 +00:00
|
|
|
|
2016-06-21 20:42:47 +00:00
|
|
|
// InstallFlags adds flags for the common options on the FlagSet
|
2017-06-01 20:34:31 +00:00
|
|
|
func (o *daemonOptions) InstallFlags(flags *pflag.FlagSet) {
|
2015-05-05 04:18:28 +00:00
|
|
|
if dockerCertPath == "" {
|
2018-10-15 07:52:53 +00:00
|
|
|
// cliconfig.Dir returns $DOCKER_CONFIG or ~/.docker.
|
|
|
|
// cliconfig.Dir does not look up $XDG_CONFIG_HOME
|
2017-06-01 20:34:31 +00:00
|
|
|
dockerCertPath = cliconfig.Dir()
|
2015-05-05 04:18:28 +00:00
|
|
|
}
|
|
|
|
|
2017-06-01 20:34:31 +00:00
|
|
|
flags.BoolVarP(&o.Debug, "debug", "D", false, "Enable debug mode")
|
2021-06-24 15:43:28 +00:00
|
|
|
flags.BoolVar(&o.Validate, "validate", false, "Validate daemon configuration and exit")
|
2017-06-01 20:34:31 +00:00
|
|
|
flags.StringVarP(&o.LogLevel, "log-level", "l", "info", `Set the logging level ("debug"|"info"|"warn"|"error"|"fatal")`)
|
2020-07-28 23:01:08 +00:00
|
|
|
flags.BoolVar(&o.TLS, FlagTLS, DefaultTLSValue, "Use TLS; implied by --tlsverify")
|
|
|
|
flags.BoolVar(&o.TLSVerify, FlagTLSVerify, dockerTLSVerify || DefaultTLSValue, "Use TLS and verify the remote")
|
2015-05-05 04:18:28 +00:00
|
|
|
|
2016-06-21 20:42:47 +00:00
|
|
|
// TODO use flag flags.String("identity"}, "i", "", "Path to libtrust key file")
|
2015-05-05 04:18:28 +00:00
|
|
|
|
2022-02-16 20:38:57 +00:00
|
|
|
o.TLSOptions = &tlsconfig.Options{}
|
2017-06-01 20:34:31 +00:00
|
|
|
tlsOptions := o.TLSOptions
|
2022-02-16 20:38:57 +00:00
|
|
|
flags.StringVar(&tlsOptions.CAFile, "tlscacert", filepath.Join(dockerCertPath, DefaultCaFile), "Trust certs signed only by this CA")
|
|
|
|
flags.StringVar(&tlsOptions.CertFile, "tlscert", filepath.Join(dockerCertPath, DefaultCertFile), "Path to TLS certificate file")
|
|
|
|
flags.StringVar(&tlsOptions.KeyFile, "tlskey", filepath.Join(dockerCertPath, DefaultKeyFile), "Path to TLS key file")
|
2015-05-05 04:18:28 +00:00
|
|
|
|
2017-06-01 20:34:31 +00:00
|
|
|
hostOpt := opts.NewNamedListOptsRef("hosts", &o.Hosts, opts.ValidateHost)
|
2016-06-22 22:36:51 +00:00
|
|
|
flags.VarP(hostOpt, "host", "H", "Daemon socket(s) to connect to")
|
2015-05-05 04:18:28 +00:00
|
|
|
}
|
|
|
|
|
2016-06-21 20:42:47 +00:00
|
|
|
// SetDefaultOptions sets default values for options after flag parsing is
|
|
|
|
// complete
|
2017-06-01 20:34:31 +00:00
|
|
|
func (o *daemonOptions) SetDefaultOptions(flags *pflag.FlagSet) {
|
2015-05-05 04:18:28 +00:00
|
|
|
// Regardless of whether the user sets it to true or false, if they
|
2016-12-20 11:14:41 +00:00
|
|
|
// specify --tlsverify at all then we need to turn on TLS
|
2016-02-19 22:42:51 +00:00
|
|
|
// TLSVerify can be true even if not set due to DOCKER_TLS_VERIFY env var, so we need
|
|
|
|
// to check that here as well
|
2017-06-01 20:34:31 +00:00
|
|
|
if flags.Changed(FlagTLSVerify) || o.TLSVerify {
|
|
|
|
o.TLS = true
|
2015-05-05 04:18:28 +00:00
|
|
|
}
|
|
|
|
|
2020-07-28 23:01:08 +00:00
|
|
|
if o.TLS && !flags.Changed(FlagTLSVerify) {
|
|
|
|
// Enable tls verification unless explicitly disabled
|
|
|
|
o.TLSVerify = true
|
|
|
|
}
|
|
|
|
|
2017-06-01 20:34:31 +00:00
|
|
|
if !o.TLS {
|
|
|
|
o.TLSOptions = nil
|
2015-05-05 04:18:28 +00:00
|
|
|
} else {
|
2017-06-01 20:34:31 +00:00
|
|
|
tlsOptions := o.TLSOptions
|
|
|
|
tlsOptions.InsecureSkipVerify = !o.TLSVerify
|
2015-05-05 04:18:28 +00:00
|
|
|
|
|
|
|
// Reset CertFile and KeyFile to empty string if the user did not specify
|
|
|
|
// the respective flags and the respective default files were not found.
|
2016-06-21 20:42:47 +00:00
|
|
|
if !flags.Changed("tlscert") {
|
2015-05-05 04:18:28 +00:00
|
|
|
if _, err := os.Stat(tlsOptions.CertFile); os.IsNotExist(err) {
|
|
|
|
tlsOptions.CertFile = ""
|
|
|
|
}
|
|
|
|
}
|
2016-06-21 20:42:47 +00:00
|
|
|
if !flags.Changed("tlskey") {
|
2015-05-05 04:18:28 +00:00
|
|
|
if _, err := os.Stat(tlsOptions.KeyFile); os.IsNotExist(err) {
|
|
|
|
tlsOptions.KeyFile = ""
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|