使用TLS增强docker的安全性
之前部署docker的时候都是没对docker的HTTP/socker接口进行加密。最近在线上部署的时候就得考虑这个。使用证书对docker进行加密主要参考官方的文档：1. https://docs.docker.com/v1.13/engine/security/https/2. https://github.com/docker/swarm/issues/341 docker engine配置TLS 主要注意做swarm cluster的时候 需要签发证书的时候subjectAltName里把本机的IP。生成证书的从网上找到的一个脚本做了修改,直接在里面把集群的IP都填进去，这样每个机器可以证书相同： #!/bin/bas h # This script will help you setup Docker for TLS authen tication. # Run it passing in the arguement for the FQDN of your docker server # For example: ./create-docker-tls.sh myhost.docker.com The script will also create a profile.d (if it exists) entry which configures your docker client to use TLS We will also overwrite /etc/sysconfig/docker (again, if it exists) to configure the daemon. A backup will be created at /etc/sysconfig/docker.unixTimestamp MIT License applies to this script. I don’t accept any responsibility for damage you may cause using it. set -e STR=2048 ...