use docker's remote API in a secure manner

user_9544130 0
Viewed 2607

I am trying to find an effective way to use the docker remote API in a secure way. I have a docker daemon running in a remote host, and a docker client on a different machine. I need my solution to not be client/server OS dependent, so that it would be relevant to any machine with a docker client/daemon etc.

So far, the only way I found to do such a thing is to create certs on a Linux machine with openssl and copy the certs to the client/server manually, as in this example:

https://docs.docker.com/engine/security/https/

and then configure docker on both sides to use the certificates for encryption and authentication.

This method is rather clunky in my opinion, because some times it's a problem to copy files and put them on each machine I want to use remote API from.

I am looking for something more elegant.

Another solution I've found is using a proxy for basic HTTP authentication, but in this method the traffic is not encrypted and it is not really secure that way.

Does anyone have a suggestion for a different solution or for a way to improve one of the above?

tls1.2 docker encryption authentication
2 Answers

Your favorite system automation tool (Chef, SaltStack, Ansible) can probably directly manage the running Docker containers on a remote host, without opening another root-equivalent network path. There are Docker-oriented clustering tools (Docker Swarm, Nomad, Kubernetes, AWS ECS) that can run a container locally or remotely, but you have less control over where exactly (you frequently don't actually care) and they tend to take over the machines they're running on.

If I really had to manage systems this way I'd probably use some sort of centralized storage to keep the TLS client keys, most likely Vault, which has the property of storing the keys encrypted, requiring some level of authentication to retrieve them, and being able to access-control them. You could write a shell function like this (untested):

dockerHost() {
  mkdir -p "$HOME/.docker/$1"
  JSON=$(vault kv get -format=json "secret/docker/$1")
  for f in ca.pem cert.pem key.pem; do
    echo "$JSON" | jq ".data.data.[\"$f\"]" > "$HOME/.docker/$1/$f"
  done
  export DOCKER_HOST="https://$1:2376"
  export DOCKER_CERT_PATH="$HOME/.docker/$1"
}

While your question makes clear you understand this, it bears repeating: do not enable unauthenticated remote access to the Docker daemon, since it is trivial to take over a host with unrestricted root access if you can access the socket at all.

user_100081730

Based on your comments, I would suggest you go with Ansible if you don't need the swarm functionality and require only single host support. Ansible only requires SSH access which you probably already have available.

It's very easy to use an existing service that's defined in Docker Compose or you can just invoke your shell scripts in Ansible. No need to expose the Docker daemon to the external world.

A very simple example file (playbook.yml)

- hosts: all
  tasks:
  - name: setup container
    docker_container:
      name: helloworld
      image: hello-world

Running the playbook ansible-playbook -i username@mysshhost.com, playbook.yml

Ansible provides pretty much all of the functionality you need to interact with Docker via its module system:

docker_service
    Use your existing Docker compose files to orchestrate containers on a single Docker daemon or on Swarm. Supports compose versions 1 and 2.
docker_container
    Manages the container lifecycle by providing the ability to create, update, stop, start and destroy a container.
docker_image
    Provides full control over images, including: build, pull, push, tag and remove.
docker_image_facts
    Inspects one or more images in the Docker host’s image cache, providing the information as facts for making decision or assertions in a playbook.
docker_login
    Authenticates with Docker Hub or any Docker registry and updates the Docker Engine config file, which in turn provides password-free pushing and pulling of images to and from the registry.
docker (dynamic inventory)
    Dynamically builds an inventory of all the available containers from a set of one or more Docker hosts.
user_3583280
Related