一、生成證書和密鑰

1、準備證書目錄和生成CA證書

# 創建證書目錄

mkdir -p /etc/docker/tls
cd /etc/docker/tls

# 生成CA密鑰和證書

openssl req -x509 -newkey rsa:4096 -keyout ca-key.pem \
-out ca-cert.pem -days 365 -nodes -subj "/CN=Docker CA"

2、為Docker守護進程（server）配置TLS證書

# 生成服務器密鑰和證書簽名請求（CSR）

openssl req -newkey rsa:4096 -keyout server-key.pem \
-out server-csr.pem -nodes -subj "/CN=192.168.XX.230"

# 創建一個配置文件

[req]
distinguished_name = req_distinguished_name
x509_extensions = v3_req
prompt = no[req_distinguished_name]
CN = 192.168.XX.230[v3_req]
keyUsage = keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names[alt_names]
IP.1 = 192.168.XX.230
IP.2 = 127.0.0.1
DNS.1 = localhost

# 使用CA證書對服務器CSR進行簽名

openssl x509 -req -in server-csr.pem -CA ca-cert.pem \
-CAkey ca-key.pem -CAcreateserial -out server-cert.pem \
-days 365 -extensions v3_req -extfile openssl.cnf

2、為Docker命令（client）配置TLS證書

# 生成客戶端密鑰和證書簽名請求（CSR）

openssl req -newkey rsa:4096 -keyout client-key.pem \
-out client-csr.pem -nodes -subj "/CN=client"

# 生成客戶端密鑰和證書簽名請求（CSR）

openssl x509 -req -in client-csr.pem -CA ca-cert.pem \
-CAkey ca-key.pem -CAcreateserial \
-out client-cert.pem -days 365

二、配置Docker守護進程

編輯Docker守護進程的配置文件（通常是/etc/docker/daemon.json），添加以下內容

{"tlsverify": true,"tlscacert": "/etc/docker/tls/ca-cert.pem","tlscert": "/etc/docker/tls/server-cert.pem","tlskey": "/etc/docker/tls/server-key.pem","hosts": ["tcp://0.0.0.0:2376"]
}

編輯Docker服務文件

#ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock
ExecStart=/usr/bin/dockerd?

systemctl daemon-reload

重啟Docker守護進程

sudo systemctl restart docker

三、配置Docker客戶端

將生成的客戶端證書和密鑰放置在客戶端機器上的一個目錄中，例如~/.docker/tls：

mkdir -p ~/.docker/tls
cp client-cert.pem ~/.docker/tls/
cp client-key.pem ~/.docker/tls/
cp ca-cert.pem ~/.docker/tls/

在運行docker命令時，指定客戶端證書和密鑰：

docker --tlsverify \--tlscacert ~/.docker/tls/ca-cert.pem \--tlscert ~/.docker/tls/client-cert.pem \--tlskey ~/.docker/tls/client-key.pem \-H tcp://192.168.XX.230:2376 \
images

為了方便，可以設置環境變量以避免每次命令都指定證書路徑：

export DOCKER_TLS_VERIFY=1
export DOCKER_CERT_PATH=~/.docker/tls
export DOCKER_HOST=tcp://192.168.XX.230:2376

環境變量場景，ca證書需要命名為ca.pem，否則找不到ca文件：Failed to initialize: unable to resolve docker endpoint: open /home/user1/.docker/tls/ca.pem: no such file or directory

好像也要指定，否則會報錯：error during connect: Get "https://192.168.XX.230:2376/v1.45/containers/json?all=1": remote error: tls: certificate required

docker --tlscert ~/.docker/tls/client-cert.pem \--tlskey ~/.docker/tls/client-key.pem \ps -a