通过ca证书的方式设置允许远程访问Docker服务

---

设置允许远程访问Docker服务

使用场景

环境

系统：anolis7.9

修改Docker服务配置，配置安全证书

生成ca证书到/etc/docker目录中，后续会要用到

#该步骤需要设置密码，后面步骤会要用到，此处设置密码为123456
openssl genrsa -aes256 -passout "pass:123456" -out /etc/docker/ca-key.pem 4096
#该步骤需要用到ca-key.pem生成时设置的密码，并录入国家、省、市、组织名称、单位名称等信息
openssl req -new -x509 -days 365 -key /etc/docker/ca-key.pem -sha256 -out /etc/docker/ca.pem -passin "pass:123456"  -subj "/C=cn/ST=STATE/L=CITY/O=ORGANIZATION/OU=ORGANIZATIONAL_UNIT/CN=COMMON_NAME/emailAddress=[e-mail]"openssl genrsa -out /etc/docker/server-key.pem 4096
openssl req -subj "/CN=Docker服务器ip或者域名" -sha256 -new -key /etc/docker/server-key.pem -out /etc/docker/server.csr
echo "subjectAltName = IP:服务器ip,IP:127.0.0.1" >> extfile.cnf
echo "extendedKeyUsage = serverAuth" >> extfile.cnf
#该步骤需要用到ca-key.pem生成时设置的密码
openssl x509 -req -days 365 -sha256 -in /etc/docker/server.csr -passin "pass:123456" -CA /etc/docker/ca.pem -CAkey /etc/docker/ca-key.pem -CAcreateserial -out /etc/docker/server-cert.pem -extfile extfile.cnf
#删除extfile.cnf
rm -f extfile.cnf
# 创建客户端私钥
openssl genrsa -out key.pem 4096
# 创建客户端签名请求证书文件
openssl req -subj '/CN=client' -sha256 -new -key /etc/docker/key.pem -out /etc/docker/client.csr
echo extendedKeyUsage = clientAuth >> extfile.cnf
# 创建签名生效的客户端证书文件
openssl x509 -req -days 365 -sha256 -in /etc/docker/client.csr -passin "pass:123456" -CA /etc/docker/ca.pem -CAkey /etc/docker/ca-key.pem -CAcreateserial -out /etc/docker/cert.pem -extfile extfile.cnf
#删除extfile.cnf
rm -f extfile.cnf
#文件赋权【非必要操作，可以视情况执行】
chmod -v 0400 "ca-key.pem" "key.pem" "server-key.pem"
chmod -v 0444 "ca.pem" "server-cert.pem" "cert.pem"

修改Docker系统文件

vim /lib/systemd/system/docker.service

修改配置，开放2375端口供客户端访问，并配置证书
原配置如下

[Unit]
Description=Docker Application Container Engine
Documentation=http://docs.docker.com
After=network.target rhel-push-plugin.service registries.service
Wants=docker-storage-setup.service
Requires=rhel-push-plugin.service registries.service
Requires=docker-cleanup.timer[Service]
Type=notify
NotifyAccess=main
EnvironmentFile=-/run/containers/registries.conf
EnvironmentFile=-/etc/sysconfig/docker
EnvironmentFile=-/etc/sysconfig/docker-storage
EnvironmentFile=-/etc/sysconfig/docker-network
Environment=GOTRACEBACK=crash
Environment=DOCKER_HTTP_HOST_COMPAT=1
Environment=PATH=/usr/libexec/docker:/usr/bin:/usr/sbin
ExecStart=/usr/bin/dockerd-current \--add-runtime docker-runc=/usr/libexec/docker/docker-runc-current \--default-runtime=docker-runc \--authorization-plugin=rhel-push-plugin \--exec-opt native.cgroupdriver=systemd \--userland-proxy-path=/usr/libexec/docker/docker-proxy-current \--init-path=/usr/libexec/docker/docker-init-current \--seccomp-profile=/etc/docker/seccomp.json \$OPTIONS \$DOCKER_STORAGE_OPTIONS \$DOCKER_NETWORK_OPTIONS \$ADD_REGISTRY \$BLOCK_REGISTRY \$INSECURE_REGISTRY \$REGISTRIES
ExecReload=/bin/kill -s HUP $MAINPID
LimitNOFILE=1048576
LimitNPROC=1048576
LimitCORE=infinity
TimeoutStartSec=0
Restart=on-abnormal
KillMode=process[Install]
WantedBy=multi-user.target

修改后如下

[Unit]
Description=Docker Application Container Engine
Documentation=http://docs.docker.com
After=network.target rhel-push-plugin.service registries.service
Wants=docker-storage-setup.service
Requires=rhel-push-plugin.service registries.service
Requires=docker-cleanup.timer[Service]
Type=notify
NotifyAccess=main
EnvironmentFile=-/run/containers/registries.conf
EnvironmentFile=-/etc/sysconfig/docker
EnvironmentFile=-/etc/sysconfig/docker-storage
EnvironmentFile=-/etc/sysconfig/docker-network
Environment=GOTRACEBACK=crash
Environment=DOCKER_HTTP_HOST_COMPAT=1
Environment=PATH=/usr/libexec/docker:/usr/bin:/usr/sbin
ExecStart=/usr/bin/dockerd-current \--tlsverify \--tlscacert=/etc/docker/ca.pem \--tlscert=/etc/docker/server-cert.pem \--tlskey=/etc/docker/server-key.pem \-H tcp://0.0.0.0:2375 \--add-runtime docker-runc=/usr/libexec/docker/docker-runc-current \--default-runtime=docker-runc \--authorization-plugin=rhel-push-plugin \--exec-opt native.cgroupdriver=systemd \--userland-proxy-path=/usr/libexec/docker/docker-proxy-current \--init-path=/usr/libexec/docker/docker-init-current \--seccomp-profile=/etc/docker/seccomp.json \$OPTIONS \$DOCKER_STORAGE_OPTIONS \$DOCKER_NETWORK_OPTIONS \$ADD_REGISTRY \$BLOCK_REGISTRY \$INSECURE_REGISTRY \$REGISTRIES
ExecReload=/bin/kill -s HUP $MAINPID
LimitNOFILE=1048576
LimitNPROC=1048576
LimitCORE=infinity
TimeoutStartSec=0
Restart=on-abnormal
KillMode=process[Install]
WantedBy=multi-user.target

然后保存文件，并重新加载Docker

systemctl daemon-reload
systemctl restart docker

此时，即可从其他服务器访问Docker服务了。需要注意的是如果Docker服务器防火墙管控严格的话，可能需要额外开放一下2375端口的防火墙。

验证

从/etc/docker目录下下载ca.pem``````cert.pem``````key.pem三个证书文件，使用curl --cert /etc/docker/cert.pem --key /etc/docker/key.pem --cacert /etc/docker/ca.pem https://ip:2375/version 命令进行验证

然后也可以通过浏览器直接访问https://docker服务器的ip:2375/version查看Docker版本，来验证当没有证书时是否能正常访问Docker服务。