Docker 签名 PDF（开发者教程

Enable Docker Content Trust

Docker Content Trust is off by default. You can turn it on by setting an environment variable DOCKER_CONTENT_TRUST to 1.

export DOCKER_CONTENT_TRUST=1

export DOCKER_CONTENT_TRUST=1

Initialize Notary Repository

Before you can actually sign an image, you have to initialize a Notary server repository. Delegation Keys and signatures for your images will be stored within it.

docker trust key generate <name>

docker trust key generate <name>

The command generates a new key pair and saves the private key locally.

Load Created Key

Use docker trust key load to load an existing private key into Docker's Trust Management system. The command is used for importing a new repository key, which a user has generated or otherwise received from another source so it can be used in signing Docker images under Docker Content Trust.

docker trust key load --name <name> <path-to-public/private-key>

docker trust key load --name <name> <path-to-public/private-key>

The image below shows the corresponding public key file.

Sign the Docker Image

One can sign an image simply by pushing it to a Docker registry. Enable Docker Content Trust; the push will sign the image.

docker push <your-registry>/<your-image>:<tag>

docker push <your-registry>/<your-image>:<tag>

If Docker Content Trust is enabled, Docker will sign the image using your private key, and the signature will also go out with that.

Verify the Signed Image

To validate a signed image, use the following command:

docker trust inspect --pretty <your-registry>/<your-image>:<tag>

docker trust inspect --pretty <your-registry>/<your-image>:<tag>

This command outputs the signing keys and the signatures associated with the image.

Manage Signing Keys

The signing keys can be managed using the docker trust signers and docker trust signer commands.

To add a signer:

docker trust signer add --key <path-to-key> <signer-name> <your-registry>/<your-image>

docker trust signer add --key <path-to-key> <signer-name> <your-registry>/<your-image>

The image below shows adding the repository key with ID into the console, and then the certificate will be added to the Docker repository showing a successfully added signer message.

Using a Custom Certificate Authority (CA)

If using a custom CA, ensure Docker trusts this CA. This typically involves placing the CA certificate in Docker’s trusted certificates.

Paste your CA certificate in the /etc/docker/certs.d/<your-registry>/ca.crt file on the Docker host.

Using Docker with TLS

To protect the Docker daemon with TLS, generate server and client certificates and configure Docker to use them.

Generate Certificates

Use OpenSSL to create the necessary certificates:

openssl genrsa -aes256 -out ca-key.pem 4096
openssl req -new -x509 -days 365 -key ca-key.pem -sha256 -out ca.pem

openssl genrsa -aes256 -out ca-key.pem 4096
openssl req -new -x509 -days 365 -key ca-key.pem -sha256 -out ca.pem

Generate server and client keys and certificates:

openssl genrsa -out server-key.pem 4096
openssl req -subj "/CN=your-server" -sha256 -new -key server-key.pem -out server.csr
openssl x509 -req -days 365 -sha256 -in server.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out server-cert.pem

openssl genrsa -out server-key.pem 4096
openssl req -subj "/CN=your-server" -sha256 -new -key server-key.pem -out server.csr
openssl x509 -req -days 365 -sha256 -in server.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out server-cert.pem

Finally, configure Docker to use these certificates by placing them in the correct directories and adjusting the Docker daemon configuration.

Configure Docker Daemon

Modify the Docker daemon’s configuration to use the generated certificates:

{
  "tls": true,
  "tlsverify": true,
  "tlscacert": "/etc/docker/ca.pem",
  "tlscert": "/etc/docker/server-cert.pem",
  "tlskey": "/etc/docker/server-key.pem",
  "hosts": ["tcp://0.0.0.0:2376", "unix:///var/run/docker.sock"]
}

Restart the Docker daemon to apply the changes.