使用TLS证书保护Docker

当我们使用远程调用docker时，未设置TLS的docker，将可以被任何人调用，这是极其危险的。

在阿里云上跑的docker，这次就被不怀好意的人扫描到了默认端口，2375/2376，被部署了挖矿软件，并且将我们自己的服务容器pause。

docker原生提供了使用TLS证书（客户端和服务端）进行安全保证。

创建证书

使用openssl来创建CA，并签署秘钥/证书。

首先创建一个certs目录，并内置三个子目录 ca、client、server。

$ mkdir -p ~/certs/{ca,client,server}

运行openssl创建CA秘钥和证书，并将CA证书保存在~/certs/ca 目录下。

$ openssl genrsa -out ~/certs/ca/ca-key.pem 2048
$ openssl req -x509 -new -nodes -key ~/certs/ca/ca-key.pem \
    -days 10000 -out ~/certs/ca/ca.pem -subj '/CN=docker-CA'

创建一个用于client的openssl配置文件~/certs/client/openssl.cnf

[req]
req_extensions = v3_req
distinguished_name = req_distinguished_name
[req_distinguished_name]
[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth, clientAuth

再创建一个用于server的openssl配置文件~/certs/server/openssl.cnf

alt_names中的ip为Docker Server的ip，即client需要访问的ip，若有多个docker服务，此处填写多个，否则client将无法访问Docker Server。

[req]
req_extensions = v3_req
distinguished_name = req_distinguished_name
[req_distinguished_name]
[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth, clientAuth
subjectAltName = @alt_names

[alt_names]
DNS.1 = docker.local
IP.1 = 192.168.9.1
IP.2 = 192.168.9.2

为客户端创建并签署证书

$ openssl genrsa -out ~/certs/client/key.pem 2048
$ openssl req -new -key ~/certs/client/key.pem -out ~/certs/client/cert.csr \
    -subj '/CN=docker-client' -config ~/certs/client/openssl.cnf
$ openssl x509 -req -in ~/certs/client/cert.csr -CA ~/certs/ca/ca.pem \
    -CAkey ~/certs/ca/ca-key.pem -CAcreateserial \
    -out ~/certs/client/cert.pem -days 365 -extensions v3_req \
    -extfile ~/certs/client/openssl.cnf

为服务端创建并签署证书

$ openssl genrsa -out ~/certs/server/key.pem 2048
$ openssl req -new -key ~/certs/server/key.pem \
    -out ~/certs/server/cert.csr \
    -subj '/CN=docker-server' -config ~/certs/server/openssl.cnf
$ openssl x509 -req -in ~/certs/server/cert.csr -CA ~/certs/ca/ca.pem \
    -CAkey ~/certs/ca/ca-key.pem -CAcreateserial \
    -out ~/certs/server/cert.pem -days 365 -extensions v3_req \
    -extfile ~/certs/server/openssl.cnf

此时，所有证书已经创建完毕，目录结构如下：

.
├── ca
│   ├── ca-key.pem
│   ├── ca.pem
│   └── ca.srl
├── client
│   ├── cert.csr
│   ├── cert.pem
│   ├── key.pem
│   └── openssl.cnf
└── server
    ├── cert.csr
    ├── cert.pem
    ├── key.pem
    └── openssl.cnf

在Docker中配置TLS证书

查看配置文件位置

$ systemctl show --property=FragmentPath docker
FragmentPath=/lib/systemd/system/docker.service

在配置文件中开启TLS，并配置服务端证书,将上一步生成好的server证书和ca.pem拷贝至/etc/docker/ssl。

ExecStart=/usr/bin/dockerd -H fd:// -H tcp://0.0.0.0:2376 -H unix:///var/run/docker.sock --tlsverify --tlscacert=/etc/docker/ssl/ca.pem --tlscert=/etc/docker/ssl/cert.pem --tlskey=/etc/docker/ssl/key.pem

重新加载systemd和Docker服务

$ sudo systemctl daemon-reload
$ sudo systemctl restart docker

此时，Docker Server端的TLS配置已经完成。

在客户端中使用TLS证书

未使用TLS证书访问Docker Server

$ docker -H tcp://192.168.9.1:2376 version
Client:
 Version:      17.03.0-ce
 API version:  1.26
 Go version:   go1.7.5
 Git commit:   3a232c8
 Built:        Tue Feb 28 08:10:07 2017
 OS/Arch:      linux/amd64
Get http://101.37.164.86:3257/v1.26/version: malformed HTTP response "\x15\x03\x01\x00\x02\x02".
* Are you trying to connect to a TLS-enabled daemon without TLS?

使用TLS证书访问DockerServer

$ docker --tlsverify --tlscacert=./ca.pem   --tlscert=./client/cert.pem --tlskey=./client/key.pem -H tcp://192.168.9.1:2376 version
Client:
 Version:      17.03.0-ce
 API version:  1.26
 Go version:   go1.7.5
 Git commit:   3a232c8
 Built:        Tue Feb 28 08:10:07 2017
 OS/Arch:      linux/amd64

Server:
 Version:      17.03.1-ce
 API version:  1.27 (minimum version 1.12)
 Go version:   go1.7.5
 Git commit:   c6d412e
 Built:        Mon Mar 27 17:14:09 2017
 OS/Arch:      linux/amd64
 Experimental: false