linux中讓 Docker 使用 HTTPS的教程

2024-08-27 23:59:21

字體：大中小

供稿：網(wǎng)友

Docker 是一個開源的應(yīng)用容器引擎,讓開發(fā)者可以打包他們的應(yīng)用以及依賴包到一個可移植的容器中,然后發(fā)布到任何流行的 Linux 機器上,也可以實現(xiàn)虛擬化,下文來看一個 Docker 使用 HTTPS的教程.

Docker 啟動監(jiān)聽端口后,使用的是 http,可以遠程來管理 Docker 主機.

這樣的場景存在弊端,API 層面是沒有提供用戶驗證、Token 之類身份驗證功能,任何人都可以通過地址加端口來控制 Docker 主機,為了避免這樣的情況發(fā)生,Docker 官方也支持 https 方式,不過需要我們自己來生成證書.

通過 OpenSSL 命令來生成 CA 證書、服務(wù)器私鑰、客戶端證書、簽名,openssl 命令比較復(fù)雜,我用腳本直接生成:

# cat certgen.sh

set -ex

[ -e certs ] || mkdir certs

cd certs

echo "Creating ca keys..."

echo 01 > ca.srl

openssl genrsa -des3 -out ca-key.pem

openssl rsa -in ca-key.pem -out ca-key.pem

openssl req -subj "/CN=$(hostname -f)/" -new -x509 -days 365 -key ca-key.pem -out ca.pem

echo "Creating server keys..."

openssl genrsa -des3 -out server-key.pem

openssl rsa -in server-key.pem -out server-key.pem

openssl req -subj "/CN=$(hostname -f)/" -new -key server-key.pem -out server.csr

openssl x509 -req -days 365 -in server.csr -CA ca.pem -CAkey ca-key.pem -out server-cert.pem

echo "Creating client keys..."

openssl genrsa -des3 -out key.pem

openssl rsa -in key.pem -out key.pem

openssl req -subj '/CN=*/' -new -key key.pem -out client.csr

echo extendedKeyUsage = clientAuth > extfile.cnf

openssl x509 -req -days 365 -in client.csr -CA ca.pem -CAkey ca-key.pem -out cert.pem -extfile extfile.cnf //Vevb.com

需要注意,在執(zhí)行腳本之前,確保你的主機名符合 FQDN 并能正常解析,不推薦修改腳本內(nèi)容 $(hostname -f) 為 IP 地址,無需修改腳本,在腳本執(zhí)行過程中會反復(fù)需要輸入密碼,統(tǒng)一輸入一個密碼就 ok:

sh certgen.sh

執(zhí)行完后,會在當前目錄下生成一個 certs 目錄,里面有生成的所有的證書文件,為了避免混淆,現(xiàn)在拷貝 CA 和服務(wù)器私鑰到其它目錄:

mkdir -p /etc/docker/certs

cd certs/

cp ca.pem server-cert.pem server-key.pem /etc/docker/certs/

服務(wù)器私鑰有了,我們也知道在哪里,現(xiàn)在只需要讓 Docker 知道:

vim /etc/default/docker

DOCKER_OPTS='-H unix:///var/run/docker.sock -H docker01.thstack.com:6732 --tlsverify --tlscacert=/etc/docker/certs/ca.pem --tlscert=/etc/docker/certs/server-cert.pem --tlskey=/etc/docker/certs/server-key.pem'

重啟 docker 服務(wù):service docker restart,添加 DOCKER_HOST 環(huán)境變量,地址為 Docker 主機的主機名,同樣如果設(shè)置 IP 地址會有問題:

# vim /etc/profile

export DOCKER_HOST=tcp://docker01.thstack.com:6732

# source /etc/profile

現(xiàn)在 Docker 已經(jīng)開啟了 https 認證,在命令行里敲 docker 命令會報錯,需要在每個 docker 命令加 –tlsverify 參數(shù),docker 命令作為一個客戶端工具來操作 Docker 主機同樣依賴客戶端證書:

root@docker01:~/certs# docker info

2014/09/14 16:19:26 Get http://docker01.thstack.com:6732/v1.14/info: malformed HTTP response "x15x03x01x00x02x02"

root@docker01:~# docker --tlsverify images

2014/09/14 16:25:53 Couldn't read ca cert /root/.docker/ca.pem: open /root/.docker/ca.pem: no such file or directory //Vevb.com

從 docker –tlsverify images 結(jié)果輸出中了解到,加了 –tlsverify 參數(shù)后,就會默認去 ~/.docker 文件中找客戶端證書,現(xiàn)在為 docker 客戶端命令添加證書:

mkdir ~/.docker

cd certs/

cp ca.pem cert.pem key.pem ~/.docker

再次嘗試執(zhí)行命令:

root@docker01:~# docker ps

2014/09/14 16:28:42 Get http://docker01.thstack.com:6732/v1.14/containers/json: malformed HTTP response "x15x03x01x00x02x02"

root@docker01:~# docker --tlsverify images

REPOSITORY          TAG                 IMAGE ID            CREATED             VIRTUAL SIZE

ubuntu              14.04.1             826544226fdc        9 days ago          194.2 MB

ubuntu              14.04               826544226fdc        9 days ago          194.2 MB

ubuntu              trusty              826544226fdc        9 days ago          194.2 MB

ubuntu              latest              826544226fdc        9 days ago          194.2 MB

ubuntu              14.10               245ce11c1f25        9 days ago          202.5 MB

ubuntu              utopic              245ce11c1f25        9 days ago          202.5 MB

ubuntu              precise             c17f3f519388        9 days ago          106.7 MB

ubuntu              12.04.5             c17f3f519388        9 days ago          106.7 MB

ubuntu              12.04               c17f3f519388        9 days ago          106.7 MB

ubuntu              12.10               c5881f11ded9        12 weeks ago        172.2 MB

ubuntu              quantal             c5881f11ded9        12 weeks ago        172.2 MB

ubuntu              13.04               463ff6be4238        12 weeks ago        169.4 MB

ubuntu              raring              463ff6be4238        12 weeks ago        169.4 MB

ubuntu              13.10               195eb90b5349        12 weeks ago        184.7 MB

ubuntu              saucy               195eb90b5349        12 weeks ago        184.7 MB

ubuntu              lucid               3db9c44f4520        4 months ago        183 MB

ubuntu              10.04               3db9c44f4520        4 months ago        183 MB

只要開啟 https 認證后,docker 命令就必須加 –tlsverify 參數(shù),上面所有的操作都是在 Docker 主機上操作,找另外一臺機器來驗證 https 是否生效:

root@ubuntu:~# curl -v -s  https://docker01.thstack.com:6732/info

* About to connect() to docker01.thstack.com port 6732 (#0)

*   Trying 192.168.3.23... connected

* successfully set certificate verify locations:

*   CAfile: none

  CApath: /etc/ssl/certs

* SSLv3, TLS handshake, Client hello (1):

* SSLv3, TLS handshake, Server hello (2):

* SSLv3, TLS handshake, CERT (11):

* SSLv3, TLS alert, Server hello (2):

* SSL certificate problem, verify that the CA cert is OK. Details:

error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

* Closing connection #0

上面提示,證書驗證失敗,在 Docker 主機上 scp 客戶端證書到這臺機器上:

root@docker01:~# cd certs/

root@docker01:~/certs# scp ca.pem cert.pem key.pem root@ubuntu:/tmp

指明證書位置來驗證,可以看到驗證過程和結(jié)果:

root@ubuntu:~# curl -v -s -k --key /tmp/key.pem --cert /tmp/cert.pem https://docker01.thstack.com:6732/info

* About to connect() to docker01.thstack.com port 6732 (#0)

*   Trying 192.168.3.23... connected

* successfully set certificate verify locations:

*   CAfile: none

  CApath: /etc/ssl/certs

* SSLv3, TLS handshake, Client hello (1):

* SSLv3, TLS handshake, Server hello (2):

* SSLv3, TLS handshake, CERT (11):

* SSLv3, TLS handshake, Server key exchange (12):

* SSLv3, TLS handshake, Request CERT (13):

* SSLv3, TLS handshake, Server finished (14):

* SSLv3, TLS handshake, CERT (11):

* SSLv3, TLS handshake, Client key exchange (16):

* SSLv3, TLS handshake, CERT verify (15):

* SSLv3, TLS change cipher, Client hello (1):

* SSLv3, TLS handshake, Finished (20):

* SSLv3, TLS change cipher, Client hello (1):

* SSLv3, TLS handshake, Finished (20):

* SSL connection using ECDHE-RSA-AES256-SHA

* Server certificate:

*        subject: CN=docker01.thstack.com

*        start date: 2014-09-14 03:27:16 GMT

*        expire date: 2015-09-14 03:27:16 GMT

*        common name: docker01.thstack.com (matched)

*        issuer: CN=docker01.thstack.com

*        SSL certificate verify result: self signed certificate (18), continuing anyway.

> GET /info HTTP/1.1

> User-Agent: curl/7.22.0 (x86_64-pc-linux-gnu) libcurl/7.22.0 OpenSSL/1.0.1 zlib/1.2.3.4 libidn/1.23 librtmp/2.3

> Host: docker01.thstack.com:6732

> Accept: */*

>

< HTTP/1.1 200 OK

< Content-Type: application/json

< Job-Name: info

< Date: Sun, 14 Sep 2014 08:43:26 GMT

< Content-Length: 417

<

{"Containers":1,"Debug":0,"Driver":"aufs","DriverStatus":[["Root Dir","/var/lib/docker/aufs"],["Dirs","36"]],"ExecutionDriver":"native-0.2","IPv4Forwarding":1,"Images":34,"IndexServerAddress":"https://index.docker.io/v1/","InitPath":"/usr/bin/docker","InitSha1":"","KernelVersion":"3.13.0-24-generic","MemoryLimit":1,"NEventsListener":0,"NFd":11,"NGoroutines":11,"OperatingSystem":"Ubuntu 14.04.1 LTS","SwapLimit":0}

* Connection #0 to host docker01.thstack.com left intact

* Closing connection #0

* SSLv3, TLS alert, Client hello (1):