1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00
Commit graph

17 commits

Author SHA1 Message Date
Lorenz Leutgeb
26187bd851 doc: Fix curl invocation
Using --insecure is (you guessed it) *insecure* as the server side
certificate is not being validated. To offer the same degree of
security as invocations of the docker client in "Secure by default"
with cURL, the trusted CA certificate must be supplied.

Signed-off-by: Lorenz Leutgeb <lorenz.leutgeb@gmail.com>
2015-01-05 01:24:33 +01:00
Lorenz Leutgeb
131c62d766 doc: Let OpenSSL handle serial file
With -CAcreateserial the serial file will be automatically created
and initialized if it is missing.

Signed-off-by: Lorenz Leutgeb <lorenz.leutgeb@gmail.com>
2015-01-04 21:49:16 +01:00
Lorenz Leutgeb
a3d5f874c1 doc: Spice up generated CA
Use AES (the successor of DES) to encrypt private key. Further
reading:

 * http://csrc.nist.gov/publications/nistpubs/800-131A/sp800-131A.pdf
 * https://ssllabs.com/downloads/SSL_TLS_Deployment_Best_Practices.pdf
   "3DES provides about 112 bits of security. This is below the
    recommended minimum of 128 bits, but it's still strong enough. A
    bigger practical problem is that 3DES is much slower than the
    alternatives. Thus, we don't recommend it for performance reasons,
    but it can be kept at the end of the cipher list for
    interoperability with very old clients."

 * http://csrc.nist.gov/publications/nistpubs/800-67-Rev1/SP-800-67-Rev1.pdf

Use SHA256 for our CA. This avoids accidental use of SHA1 or MD5 which
could be default values.

Signed-off-by: Lorenz Leutgeb <lorenz.leutgeb@gmail.com>
2015-01-04 21:45:06 +01:00
Lorenz Leutgeb
f957f258d7 doc: Do not encrypt private keys
Do not encrypt private keys in the first place, if the encryption
is stripped anyway.

Signed-off-by: Lorenz Leutgeb <lorenz.leutgeb@gmail.com>
2015-01-04 21:05:54 +01:00
Neal McBurnett
ee1ba25218 Fixes #9555: sudo not needed with cert authn
Signed-off-by: Neal McBurnett <neal@mcburnett.org>
2014-12-07 14:31:35 -07:00
Sven Dowideit
1c68de798f Add a little info on how to talk to the TLS encrypted Docker Socket
Docker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@docker.com> (github: SvenDowideit)
2014-10-15 17:24:53 +10:00
Aanand Prasad
19fb942d36 Add DOCKER_TLS_VERIFY environment variable, equivalent to --tlsverify flag
This makes it possible to make the Docker client "secure by default"
without wrapping the binary in a shell alias so that `--tlsverify` is
always passed.

Signed-off-by: Aanand Prasad <aanand.prasad@gmail.com>
2014-10-13 11:49:26 +01:00
Sven Dowideit
fc9a3b1c1b Consistently use 'sudo docker' in examples
Docker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@docker.com> (github: SvenDowideit)
2014-09-16 11:49:05 +10:00
Sven Dowideit
b94f2c4c6d tell the user what to expect, including that it is a verbode process.
Docker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@docker.com> (github: SvenDowideit)
2014-08-12 10:32:38 +10:00
Ben Firshman
a49de2c467 Rename DOCKER_CONFIG envvar to DOCKER_CERT_PATH
DOCKER_CONFIG was introduced in #6984.

We may use "config" for other purposes (e.g. #7232). Until we
have made a design decision around how configuration files will
work, DOCKER_CERT_PATH is a much safer name to rely on for future
compatibility.

Docker-DCO-1.1-Signed-off-by: Ben Firshman <ben@firshman.co.uk> (github: bfirsh)
2014-08-04 17:36:53 -07:00
O.S. Tezer
711fb3e19d Docs: articles/https minor amendments and update
This commit proposes some minor amendments and updates
for the articles/https.md document to fix certain errors, inc.:

 - Marking commands / flags as code (e.g. `tlsverify`) [done before rebase]
 - Capitalising the word Docker
 - Normalizing headers to match the rest of the docs;
 - Expanding the page description to match the page title and the content;
 - Capitalizing HTTPS etc.;
 - Some spelling error fixes;
 - Line-length adjustments to make it easier to read the raw file.

It does not propose any fundemental changes to the structure of the document.
Certain changes were based before another update on this doc.

Docker-DCO-1.1-Signed-off-by: O.S. Tezer <ostezer@gmail.com> (github: ostezer)
2014-07-30 18:09:58 +03:00
soulshake
319a8a241e Resolve merge conflict, attempt 3
Docker-DCO-1.1-Signed-off-by: AJ Bowen <aj@gandi.net> (github: soulshake)
2014-07-21 12:18:59 -07:00
James Kyle
c0471ee35a Closes 6937. Allows setting of docker config dir.
Can now dynamically set the docker config directory through an
environment variable.

export DOCKER_CONFIG=/path/to/docker_config/

Default behavior remains the same, e.g. ~/.docker

Documentation for change added to the https.md docs.

Docker-DCO-1.1-Signed-off-by: James A. Kyle <james@jameskyle.org> (github: jameskyle)
2014-07-15 15:47:00 -07:00
Aaron Huslage
c3d91263a8 Clarified TLS Docs
Made a "Secure by default" section, create 2048-bit keys, various cleanups.

Docker-DCO-1.1-Signed-off-by: Aaron Huslage <huslage@gmail.com> (github: huslage)
2014-07-11 14:35:01 -04:00
SvenDowideit
fde10cf87b blindly make all uses of e\.?g\.? into e.g.,
Docker-DCO-1.1-Signed-off-by: SvenDowideit <SvenDowideit@home.org.au> (github: SvenDowideit)
2014-07-01 09:55:19 +10:00
SvenDowideit
5febba93ba IANA allocated Docker port: 2375
2375/2376 are assigned:
http://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=docker

For #1440

Docker-DCO-1.1-Signed-off-by: SvenDowideit <SvenDowideit@home.org.au> (github: SvenDowideit)
2014-06-04 06:54:19 +10:00
James Turnbull
a7b2c4804b Adding User Guide
* Added User Guide section outlines.
* Added User Guide to menu.
* Moved HTTPS example to articles.
* Replaced Hello World example with User Guide.
* Moved use cases out of examples.
* Updated Introduction to add User Guide.
* Redirected migrated /use and /articles links.
* Added Docker.io section
* Added Dockerized section
* Added Using Docker section
* Added Docker Images section
* Added Docker Links section
* Added Docker Volumes section

Docker-DCO-1.1-Signed-off-by: James Turnbull <james@lovedthanlost.net> (github: jamtur01)
2014-06-01 17:34:07 -04:00
Renamed from docs/sources/examples/https.md (Browse further)