Icône de message
Passer au contenu du pied de page
  1. IronSecureDoc
  2. Blog IronSecureDoc
  3. Utilisation de IronSecureDoc
  4. signer PDF avec Docker
UTILISATION DE IRONSECUREDOC

Docker signer PDF (Tutoriel Développeur

Curtis Chau
Curtis Chau
Mis à jour:

In a fast-moving environment of software development and deployment, one would consider security at the top of their priority list. Docker is a containerization platform popular because of the benefits it brings to an application regarding consistency, scalability, and isolation. As usual, though, any technology can turn out vulnerable in case improper practices are followed in its operation. One of the most important aspects when it comes to Docker Security is keeping a clean and full-of-trust Docker image. Here is where Docker Signer Add steps in. The following article will look into what Docker Signer is, why it is important, and how to effectively implement it in your development pipeline.

What is Docker Signer?

Docker Signer is a utility designed to enhance the security of Docker images through the use of digital signatures. The signature is used to provide authentication and validation of integrity for Docker images, thereby ensuring that no tampering or alteration of any kind has taken place.

In the case of digital signatures, they are usable after generating a cryptographic signature of the docker image to prove that no image modifications have been performed since the image was signed. Plugging Docker Signer into your CI/CD pipeline means you're applying a strong security model in which you only deploy trusted images.

Why is Docker Signer Important?

  • Integrity Verification: A Docker image is essentially just a tarball of files and metadata. There's no guarantee, otherwise, that the thing you're deploying is what you intend. Docker Signer provides the means to assure integrity, checking the images haven't changed or are corrupted.

  • Authentication: Digital signatures ensure the Docker image source. It means you have an assurance that it came from someone you trust and nothing changed in transit.

  • Compliance and Auditing: Many industries and enterprises have tough compliance requirements concerning security and auditing. The Docker signer aids in compliance through a very clear trail of image authenticity and integrity.

  • Trust Management: This goes without saying in any multi-team or multi-organization setup. Docker Signer allows trust management by not using unsigned images—source-verified, at a minimum.

How Docker Signer Works

Docker Signer uses some cryptography techniques to generate and verify signatures. The steps are as follows:

1. Docker Image Signing:

  • Generate Signature: Cryptographically generates a digital signature for the container in building a Docker container with a previously used root key and created private key as part of a public-private key pair.

  • Include Signature in Image: This outputted signature will be applied to the Docker container, either via associated metadata or in an entirely different signature file.

2. Docker Image Verification:

  • Signature Verification: Docker Signer checks an image's signature on the corresponding public key with the ID of some deployed or pulled private key for which a corresponding private key had been used in signing its Docker image.

  • Integrity Check: Verification Succeeded—Proof that an image has not been modified since signing; Verification Failed—Probable tampering or corruption.

Implementing Docker Signer With IronSecureDoc

To implement Docker Signer effectively, follow these steps:

Steps To Set Up Docker Signer add

Enable Docker Content Trust

Docker Content Trust is off by default. You can turn it on by setting an environment variable DOCKER_CONTENT_TRUST to 1.

export DOCKER_CONTENT_TRUST=1
export DOCKER_CONTENT_TRUST=1
SHELL

Initialize Notary Repository

Before you can actually sign an image, you have to initialize a Notary server repository. Delegation Keys and signatures for your images will be stored within it.

docker trust key generate <name>
docker trust key generate <name>
SHELL

The command generates a new key pair and saves the private key locally.

Docker Sign Pdf 1 related to Initialize Notary Repository

Load Created Key

Use docker trust key load to load an existing private key into Docker's Trust Management system. The command is used for importing a new repository key, which a user has generated or otherwise received from another source so it can be used in signing Docker images under Docker Content Trust.

docker trust key load --name <name> <path-to-public/private-key>
docker trust key load --name <name> <path-to-public/private-key>
SHELL

The image below shows the corresponding public key file.

Docker Sign Pdf 2 related to Load Created Key

Sign the Docker Image

One can sign an image simply by pushing it to a Docker registry. Enable Docker Content Trust; the push will sign the image.

docker push <your-registry>/<your-image>:<tag>
docker push <your-registry>/<your-image>:<tag>
SHELL

If Docker Content Trust is enabled, Docker will sign the image using your private key, and the signature will also go out with that.

Verify the Signed Image

To validate a signed image, use the following command:

docker trust inspect --pretty <your-registry>/<your-image>:<tag>
docker trust inspect --pretty <your-registry>/<your-image>:<tag>
SHELL

This command outputs the signing keys and the signatures associated with the image.

docker trust inspect command to validate a signed image

Manage Signing Keys

The signing keys can be managed using the docker trust signers and docker trust signer commands.

To add a signer:

docker trust signer add --key <path-to-key> <signer-name> <your-registry>/<your-image>
docker trust signer add --key <path-to-key> <signer-name> <your-registry>/<your-image>
SHELL

The image below shows adding the repository key with ID into the console, and then the certificate will be added to the Docker repository showing a successfully added signer message.

docker trust signer command to add repository key

Using a Custom Certificate Authority (CA)

If using a custom CA, ensure Docker trusts this CA. This typically involves placing the CA certificate in Docker’s trusted certificates.

Paste your CA certificate in the /etc/docker/certs.d/<your-registry>/ca.crt file on the Docker host.

Using Docker with TLS

To protect the Docker daemon with TLS, generate server and client certificates and configure Docker to use them.

Generate Certificates

Use OpenSSL to create the necessary certificates:

openssl genrsa -aes256 -out ca-key.pem 4096
openssl req -new -x509 -days 365 -key ca-key.pem -sha256 -out ca.pem
openssl genrsa -aes256 -out ca-key.pem 4096
openssl req -new -x509 -days 365 -key ca-key.pem -sha256 -out ca.pem
SHELL

Generate server and client keys and certificates:

openssl genrsa -out server-key.pem 4096
openssl req -subj "/CN=your-server" -sha256 -new -key server-key.pem -out server.csr
openssl x509 -req -days 365 -sha256 -in server.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out server-cert.pem
openssl genrsa -out server-key.pem 4096
openssl req -subj "/CN=your-server" -sha256 -new -key server-key.pem -out server.csr
openssl x509 -req -days 365 -sha256 -in server.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out server-cert.pem
SHELL

Finally, configure Docker to use these certificates by placing them in the correct directories and adjusting the Docker daemon configuration.

Configure Docker Daemon

Modify the Docker daemon’s configuration to use the generated certificates:

{
  "tls": true,
  "tlsverify": true,
  "tlscacert": "/etc/docker/ca.pem",
  "tlscert": "/etc/docker/server-cert.pem",
  "tlskey": "/etc/docker/server-key.pem",
  "hosts": ["tcp://0.0.0.0:2376", "unix:///var/run/docker.sock"]
}

Restart the Docker daemon to apply the changes.

What is IronSecureDoc?

IronSecureDoc is an enterprise-level document security solution that protects confidential documents from unauthorized access and data leakage. It includes powerful industry-grade encryption at rest and in transit, providing assurance that your documents are stored and transferred safely. It incorporates detailed access controls to control user permission levels for document viewing and editing. Additionally, it provides advanced data manipulation tools to obscure critical information before sharing.

IronSecureDoc: The PDF Security and Compliance Server

IronSecureDoc includes real-time tracking, auditing, and activities logging with documents, supporting GDPR and HIPAA compliance. It integrates with Document Management Systems and Collaboration Platforms for enhanced security without disrupting workflows, protecting critical information, and providing a compliance-ready format. It's especially suitable for industries like financial, health, and legal sectors. For usage details, refer to the tutorial page.

Advantages of Adding Signer to IronSecureDoc

Signing Docker images within the IronSecureDoc framework inherits all Docker image signing security capabilities and augments them with IronSecureDoc's specialized functionalities. Benefits include:

End-to-End Security and Compliance

  • More Confident Image Integrity: Ensures integrity from 'Build' to 'Run'. Signed images can't be altered without authorization.

  • Regulatory Compliance: IronSecureDoc targets several security standards, simplifying Docker signer's fit within strict industry regulations for auditing.

Single Pane of Security

  • Integrated Security Management: Completely manages and secures documents and images, centralizing consistent enforcement of security policies.

  • Seamless Workflow Integration: Integrate image signing with existing security workflows, reducing complexity and security gaps.

More Secure Supply Chains

  • CI/CD Secure Pipelines: Ensures Docker images are verified before deployment, enhancing supply chain security.

  • Secure Deployment: Reduces the risk of supply chain attacks, ensuring only valid, trusted images are used in production.

Conclusion

Integrate Docker image signing with IronSecureDoc for high security, compliance, and operational efficiency in your containerized applications. This ensures Docker images aren't tampered with, meet regulatory standards, and maintain a verifiable trust chain throughout your software supply chain. Bring Docker signing under the IronSecureDoc framework for unified, automated digital asset security, simplifying compliance and fostering stakeholder trust by protecting your brand and deployments across environments.

IronSecureDoc: License Information

IronSecureDoc offers a free-trial. For enterprise licensing, visit the license page. IronSecureDoc provides comprehensive documentation to help get started. Iron Software offers other products like IronPDF, IronXL, IronOCR, and more for solutions related to PDF conversion, Excel tasks, OCR processing, etc. Learn more on our website.

Questions Fréquemment Posées

Comment puis-je signer un PDF avec Docker?

Pour signer un PDF avec Docker, vous pouvez intégrer Docker Signer avec une solution de sécurité documentaire comme IronSecureDoc. Cela garantit que le PDF est signé de manière sécurisée et que l'intégrité du document est maintenue grâce à des signatures numériques cryptographiques.

Qu'est-ce que Docker Signer et comment améliore-t-il la sécurité?

Docker Signer est un utilitaire qui améliore la sécurité des images Docker en utilisant des signatures numériques. Il garantit l'intégrité et l'authenticité des images Docker, vérifiant qu'elles n'ont pas été manipulées et authentifiant leur source.

Quelles étapes sont impliquées dans la mise en œuvre de Docker Signer?

La mise en œuvre de Docker Signer implique d'activer Docker Content Trust, d'initialiser un dépôt Notary, de gérer les clés de signature, et de signer les images Docker en les poussant vers un registre. Ce processus garantit que les images sont sécurisées et dignes de confiance.

Comment Docker Signer peut-il être intégré aux solutions de sécurité documentaire?

Docker Signer peut être intégré aux solutions de sécurité documentaire comme IronSecureDoc pour garantir une sécurité de bout en bout. Cette intégration aide à protéger l'intégrité et l'authenticité des images Docker, soutenant la conformité avec les normes de l'industrie et améliorant la sécurité du pipeline CI/CD.

Pourquoi la signature d'image Docker est-elle importante dans les pipelines CI/CD?

La signature d'image Docker est cruciale dans les pipelines CI/CD car elle vérifie que les images utilisées sont authentiques et non modifiées. Cela maintient un pipeline sécurisé en garantissant que seules les images Docker de confiance sont déployées, réduisant les risques de la chaîne d'approvisionnement.

Comment Docker Signer contribue-t-il à la conformité réglementaire?

Docker Signer aide à la conformité réglementaire en maintenant une trace vérifiable de l'authenticité et de l'intégrité des images. Cela aligne avec les normes de l'industrie et les exigences d'audit, garantissant que les organisations respectent les directives de conformité nécessaires.

Quel rôle joue Docker Content Trust dans la sécurité des images?

Docker Content Trust garantit que les images Docker sont signées et vérifiées avant utilisation. En activant Docker Content Trust, vous pouvez garantir que seules les images de confiance, authentifiées par des signatures numériques, sont utilisées.

Comment puis-je assurer une communication sécurisée pour les images Docker?

Vous pouvez assurer une communication sécurisée pour les images Docker en utilisant une autorité de certification (CA) personnalisée. Cela implique de placer le certificat de la CA dans les certificats de confiance de Docker, qui gère de manière sécurisée les communications d'images.

Curtis Chau
Curtis Chau
  Discutez maintenant avec l'équipe d'ingénierie
Rédacteur technique

Curtis Chau détient un baccalauréat en informatique (Université de Carleton) et se spécialise dans le développement front-end avec expertise en Node.js, TypeScript, JavaScript et React. Passionné par la création d'interfaces utilisateur intuitives et esthétiquement plaisantes, Curtis aime travailler avec des frameworks modernes ...

Lire la suite

Articles connexes

Essai de 30 jours → Produit complet. Pas de limites. Pas de carte. Démarrer l'essai gratuit