Please enable JavaScript.

Coggle requires JavaScript to display documents.

Security (Security (Default engine security (Verify repository client with…

- - - - by default, Docker runs via a non-networked
        Unix socket and TLS must be enabled in order to
        have the Docker client and the daemon communicate
        securely over HTTPS. TLS ensures authenticity of
        the registry endpoint and that traffic to/from registry
        is encrypted.
      - A custom certificate is configured by creating
        a directory under /etc/docker/certs.d using the
        same name as the registry’s hostname, such
        as localhost. All *.crt files are added to this directory
        as CA roots.
      - /etc/docker/certs.d/ <-- Certificate directory
        └── localhost:5000 <-- Hostname:port
        ├── client.cert <-- Client certificate
        ├── client.key <-- Client key
        └── ca.crt <-- Certificate authority that signed the registry certificate
      - Create the client certificate:
        $ openssl genrsa -out client.key 4096
        $ openssl req -new -x509 -text -key client.key -out client.cert
    - - Secure computing mode (seccomp) is a Linux kernel feature. You can use it to restrict the actions available within the container.
      - $ grep CONFIG_SECCOMP= /boot/config-$(uname -r)
        CONFIG_SECCOMP=y
      - $ docker run --rm \ --it\
        --security-opt seccomp=/path/to/seccomp/profile.json \
        helloworls**
      - Run without the default seccomp profile
        $ docker run --rm -it --security-opt seccomp=unconfined debian:jessie \
        unshare --map-root-user --user sh -c whoami
    - - Signing Images with Docker Content Trust
        
        $ docker trust key generate jeff
        $ docker trust key load key.pem --name jeff
        add the delegation public key to the Notary server
        $ docker trust signer add --key cert.pem jeff dtr.example.com/admin/demo
        Finally, we will use the delegation private key to sign a particular tag and push it up to the registry
        
        $ docker trust sign dtr.example.com/admin/demo:1
        Alternatively, once the keys have been imported an image can be pushed with the $ docker push command, by exporting the DCT environmental variable.
        $ export DOCKER_CONTENT_TRUST=1
        $ docker push dtr.example.com/admin/demo:1
        Remote trust data for a tag or a repository can be viewed by the $ docker trust inspect command:
        $ docker trust inspect --pretty dtr.example.com/admin/demo:1
        Remote Trust data for a tag can be removed by the $ docker trust revoke command:
        $ docker trust revoke dtr.example.com/admin/demo:1
        
        By default this is stored in ~/.docker/trust
        
        Enabling DCT within the Docker Enterprise engine :red_flag:
        /etc/docker/daemon.json
        mode : permissive, disabled, enforced
        {
        "content-trust": {
        "trust-pinning": {
        "offcial-library-images": true ====> docker-signed image
        "mode": "enforced"
        }
        }
        user-signed image
        {
        "content-trust": {
        "trust-pinning":{
        "mydtr/user1/*": [
        "0b6101527b2ac766702e4b40aa2391805b70e5031c04714c748f914e89014403"
        ]
        }
        },
        "mode": "enforced"
        }
        }
        
        Runtime Enforcement with Docker : :red_flag:
        Content Engine Signature Verification prevents the following:
        $ docker container run of an unsigned or altered image.
        $ docker pull of an unsigned or altered image.
        $ docker build where the FROM image is not signed or is not scratch
        $ docker service create
        $docker service update
        
        Client Enforcement with Docker Content Trust : :red_flag:
        currently, content trust is disabled by default in the Docker Client. To enable it, set the DOCKER_CONTENT_TRUST environment variable to 1
        
        When DCT is enabled in the Docker client, docker CLI commands that operate on tagged images must either have content signatures or explicit content hashes. The commands that operate with DCT are pull push run create build
        For example, with DCT enabled a docker pull someimage:latest only succeeds if someimage:latest is signed. However, an operation with an explicit content hash always succeeds as long as the hash exists
      - Docker Content Trust Keys
      - DCT is associated with the TAG portion of an image
      - Manage keys for content trust https://docs.docker.com/engine/security/trust/trust_key_mng/
    - - Secure by default $ mkdir -pv ~/.docker
        $ cp -v {ca,cert,key}.pem ~/.docker
        $export DOCKER_HOST=tcp://$HOST:2376 DOCKER_TLS_VERIFY=1
      - By default, Docker runs through a non-networked UNIX socket. It can also optionally communicate using an HTTP socket.
        If you need Docker to be reachable through the network in a safe manner, you can enable TLS by specifying the tlsverify flag and pointing Docker’s tlscacert flag to a trusted CA certificate
        $ docker --tlsverify --tlscacert=ca.pem --tlscert=cert.pem --tlskey=key.pem -H=$HOST:2376 version
      - Other modes: :red_flag:
        Daemon modes:
        authenticate clients= tlsverify, tlscacert, tlscert,tlskey
        Do not authenticate client=tls, tlscert, tlskey
        Client modes:
        authenticate server based on pub/default CA pool= tls
        auth based on give ca=tlsverify, tlscacert
        auth with client certif, do not authen server based on given ca =tls,tlscert,tlskey
        auth with client cert and auth server based on goven ca tlsverify,tlscacert,tlscert,tlskey