kotovalexarian-likes-github/moby--moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00
Code Releases Activity

Merge pull request #17388 from vikstrous/notary_docs

Browse source 
more notary documentation
This commit is contained in:
moxiegirl 2015-11-11 20:07:55 -08:00
commit 40ed821d2e
3 changed files with 49 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
docs/reference/commandline/cli.md
View file

@ -48,6 +48,8 @@ by the `docker` command line:
* `DOCKER_TLS_VERIFY` When set Docker uses TLS and verifies the remote.
* `DOCKER_CONTENT_TRUST` When set Docker uses notary to sign and verify images.
Equates to `--disable-content-trust=false` for build, create, pull, push, run.
* `DOCKER_CONTENT_TRUST_SERVER` The URL of the Notary server to use. This defaults
to the same URL as the registry.
* `DOCKER_TMPDIR` Location for temporary Docker files.
Because Docker is developed using 'Go', you can also use any environment
@ -109,6 +111,15 @@ Following is a sample `config.json` file:
"psFormat": "table {{.ID}}\\t{{.Image}}\\t{{.Command}}\\t{{.Labels}}"
}
### Notary
If using your own notary server and a self-signed certificate or an internal
Certificate Authority, you need to place the certificate at
`tls/<registry_url>/ca.crt` in your docker config directory.
Alternatively you can trust the certificate globally by adding it to your system's
list of root Certificate Authorities.
## Help
To list the help on any command just execute the command, followed by the

5
docs/security/trust/content_trust.md
View file

@ -31,7 +31,10 @@ Docker registries. These signatures allow client-side verification of the
integrity and publisher of specific image tags.
Currently, content trust is disabled by default. You must enabled it by setting
the `DOCKER_CONTENT_TRUST` environment variable.
the `DOCKER_CONTENT_TRUST` environment variable. Refer to the
[environment variables](../../reference/commandline/cli.md#environment-variables)
and [Notary](../../reference/commandline/cli.md#notary) configuration
for the docker client for more options.
Once content trust is enabled, image publishers can sign their images. Image consumers can
ensure that the images they use are signed. publishers and consumers can be

34
docs/security/trust/deploying_notary.md Normal file
View file

@ -0,0 +1,34 @@
<!--[metadata]>
+++
title = "Deploying Notary"
description = "Deploying Notary"
keywords = ["trust, security, notary, deployment"]
[menu.main]
parent= "smn_content_trust"
+++
<![end-metadata]-->
# Deploying Notary Server with Compose
The easiest way to deploy Notary Server is by using Docker Compose. To follow the procedure on this page, you must have already [installed Docker Compose](../../../compose/install.md).
1. Clone the Notary repository
git clone git@github.com:docker/notary.git
2. Build and start Notary Server with the sample certificates.
docker-compose up -d
For more detailed documentation about how to deploy Notary Server see https://github.com/docker/notary.
3. Make sure that your Docker or Notary client trusts Notary Server's certificate before you try to interact with the Notary server.
See the instructions for [Docker](../../reference/commandline/cli.md#notary) or
for [Notary](https://github.com/docker/notary#using-notary) depending on which one you are using.
## If you want to use Notary in production
Please check back here for instructions after Notary Server has an official
stable release. To get a head start on deploying Notary in production see
https://github.com/docker/notary.