diff options
Diffstat (limited to 'docs/sources/articles')
| -rw-r--r-- | docs/sources/articles/cfengine_process_management.md | 7 | ||||
| -rw-r--r-- | docs/sources/articles/dsc.md | 90 | ||||
| -rw-r--r-- | docs/sources/articles/https.md | 109 | ||||
| -rw-r--r-- | docs/sources/articles/using_supervisord.md | 8 |
4 files changed, 155 insertions, 59 deletions
diff --git a/docs/sources/articles/cfengine_process_management.md b/docs/sources/articles/cfengine_process_management.md index 6bb4df66ae..a9441a6d35 100644 --- a/docs/sources/articles/cfengine_process_management.md +++ b/docs/sources/articles/cfengine_process_management.md @@ -65,13 +65,12 @@ The first two steps can be done as part of a Dockerfile, as follows. FROM ubuntu MAINTAINER Eystein Måløy Stenberg <eytein.stenberg@gmail.com> - RUN apt-get -y install wget lsb-release unzip ca-certificates + RUN apt-get update && apt-get install -y wget lsb-release unzip ca-certificates # install latest CFEngine RUN wget -qO- http://cfengine.com/pub/gpg.key | apt-key add - RUN echo "deb http://cfengine.com/pub/apt $(lsb_release -cs) main" > /etc/apt/sources.list.d/cfengine-community.list - RUN apt-get update - RUN apt-get install cfengine-community + RUN apt-get update && apt-get install -y cfengine-community # install cfe-docker process management policy RUN wget https://github.com/estenberg/cfe-docker/archive/master.zip -P /tmp/ && unzip /tmp/master.zip -d /tmp/ @@ -80,7 +79,7 @@ The first two steps can be done as part of a Dockerfile, as follows. RUN rm -rf /tmp/cfe-docker-master /tmp/master.zip # apache2 and openssh are just for testing purposes, install your own apps here - RUN apt-get -y install openssh-server apache2 + RUN apt-get update && apt-get install -y openssh-server apache2 RUN mkdir -p /var/run/sshd RUN echo "root:password" | chpasswd # need a password for ssh diff --git a/docs/sources/articles/dsc.md b/docs/sources/articles/dsc.md index 94f5e9d4db..5e05c40c14 100644 --- a/docs/sources/articles/dsc.md +++ b/docs/sources/articles/dsc.md @@ -8,7 +8,7 @@ Windows PowerShell Desired State Configuration (DSC) is a configuration management tool that extends the existing functionality of Windows PowerShell. DSC uses a declarative syntax to define the state in which a target should be configured. More information about PowerShell DSC can be found at -http://technet.microsoft.com/en-us/library/dn249912.aspx. +[http://technet.microsoft.com/en-us/library/dn249912.aspx](http://technet.microsoft.com/en-us/library/dn249912.aspx). ## Requirements @@ -17,14 +17,14 @@ To use this guide you'll need a Windows host with PowerShell v4.0 or newer. The included DSC configuration script also uses the official PPA so only an Ubuntu target is supported. The Ubuntu target must already have the required OMI Server and PowerShell DSC for Linux providers installed. More -information can be found at https://github.com/MSFTOSSMgmt/WPSDSCLinux. The -source repository listed below also includes PowerShell DSC for Linux +information can be found at [https://github.com/MSFTOSSMgmt/WPSDSCLinux](https://github.com/MSFTOSSMgmt/WPSDSCLinux). +The source repository listed below also includes PowerShell DSC for Linux installation and init scripts along with more detailed installation information. ## Installation The DSC configuration example source is available in the following repository: -https://github.com/anweiss/DockerClientDSC. It can be cloned with: +[https://github.com/anweiss/DockerClientDSC](https://github.com/anweiss/DockerClientDSC). It can be cloned with: $ git clone https://github.com/anweiss/DockerClientDSC.git @@ -37,15 +37,18 @@ be used to establish the required CIM session(s) and execute the `Set-DscConfiguration` cmdlet. More detailed usage information can be found at -https://github.com/anweiss/DockerClientDSC. +[https://github.com/anweiss/DockerClientDSC](https://github.com/anweiss/DockerClientDSC). -### Run Configuration +### Install Docker The Docker installation configuration is equivalent to running: ``` -apt-get install docker.io -ln -sf /usr/bin/docker.io /usr/local/bin/docker -sed -i '$acomplete -F _docker docker' /etc/bash_completion.d/docker.io +apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys\ +36A1D7869245C8950F966E92D8576A8BA88D21E9 +sh -c "echo deb https://get.docker.io/ubuntu docker main\ +> /etc/apt/sources.list.d/docker.list" +apt-get update +apt-get install lxc-docker ``` Ensure that your current working directory is set to the `DockerClientDSC` @@ -83,35 +86,82 @@ file and execute configurations against multiple nodes as such: ``` ### Images -Image configuration is equivalent to running: `docker pull [image]`. +Image configuration is equivalent to running: `docker pull [image]` or +`docker rmi -f [IMAGE]`. -Using the same Run Configuration steps defined above, execute `DockerClient` -with the `Image` parameter: +Using the same steps defined above, execute `DockerClient` with the `Image` +parameter and apply the configuration: ```powershell -DockerClient -Hostname "myhost" -Image node +DockerClient -Hostname "myhost" -Image "node" +.\RunDockerClientConfig.ps1 -Hostname "myhost" ``` -The configuration process can be initiated as before: +You can also configure the host to pull multiple images: ```powershell +DockerClient -Hostname "myhost" -Image "node","mongo" .\RunDockerClientConfig.ps1 -Hostname "myhost" ``` +To remove images, use a hashtable as follows: + +```powershell +DockerClient -Hostname "myhost" -Image @{Name="node"; Remove=$true} +.\RunDockerClientConfig.ps1 -Hostname $hostname +``` + ### Containers Container configuration is equivalent to running: -`docker run -d --name="[containername]" [image] '[command]'`. -Using the same Run Configuration steps defined above, execute `DockerClient` -with the `Image`, `ContainerName`, and `Command` parameters: +``` +docker run -d --name="[containername]" -p '[port]' -e '[env]' --link '[link]'\ +'[image]' '[command]' +``` +or + +``` +docker rm -f [containername] +``` + +To create or remove containers, you can use the `Container` parameter with one +or more hashtables. The hashtable(s) passed to this parameter can have the +following properties: + +- Name (required) +- Image (required unless Remove property is set to `$true`) +- Port +- Env +- Link +- Command +- Remove + +For example, create a hashtable with the settings for your container: + +```powershell +$webContainer = @{Name="web"; Image="anweiss/docker-platynem"; Port="80:80"} +``` + +Then, using the same steps defined above, execute +`DockerClient` with the `-Image` and `-Container` parameters: ```powershell -DockerClient -Hostname "myhost" -Image node -ContainerName "helloworld" ` --Command 'echo "Hello World!"' +DockerClient -Hostname "myhost" -Image node -Container $webContainer +.\RunDockerClientConfig.ps1 -Hostname "myhost" ``` -The configuration process can be initiated as before: +Existing containers can also be removed as follows: ```powershell +$containerToRemove = @{Name="web"; Remove=$true} +DockerClient -Hostname "myhost" -Container $containerToRemove .\RunDockerClientConfig.ps1 -Hostname "myhost" ``` + +Here is a hashtable with all of the properties that can be used to create a +container: + +```powershell +$containerProps = @{Name="web"; Image="node:latest"; Port="80:80"; ` +Env="PORT=80"; Link="db:db"; Command="grunt"} +```
\ No newline at end of file diff --git a/docs/sources/articles/https.md b/docs/sources/articles/https.md index 81570105e6..8a7b2dea4c 100644 --- a/docs/sources/articles/https.md +++ b/docs/sources/articles/https.md @@ -1,6 +1,6 @@ -page_title: Docker HTTPS Setup -page_description: How to setup docker with https -page_keywords: docker, example, https, daemon +page_title: Running Docker with HTTPS +page_description: How to setup and run Docker with HTTPS +page_keywords: docker, docs, article, example, https, daemon, tls, ca, certificate # Running Docker with https @@ -11,9 +11,9 @@ If you need Docker reachable via the network in a safe manner, you can enable TLS by specifying the tlsverify flag and pointing Docker's tlscacert flag to a trusted CA certificate. -In daemon mode, it will only allow connections from clients -authenticated by a certificate signed by that CA. In client mode, it -will only connect to servers with a certificate signed by that CA. +In the daemon mode, it will only allow connections from clients +authenticated by a certificate signed by that CA. In the client mode, +it will only connect to servers with a certificate signed by that CA. > **Warning**: > Using TLS and managing a CA is an advanced topic. Please make you self @@ -31,25 +31,64 @@ keys: $ echo 01 > ca.srl $ openssl genrsa -des3 -out ca-key.pem 2048 + Generating RSA private key, 2048 bit long modulus + ......+++ + ...............+++ + e is 65537 (0x10001) + Enter pass phrase for ca-key.pem: + Verifying - Enter pass phrase for ca-key.pem: $ openssl req -new -x509 -days 365 -key ca-key.pem -out ca.pem + Enter pass phrase for ca-key.pem: + You are about to be asked to enter information that will be incorporated + into your certificate request. + What you are about to enter is what is called a Distinguished Name or a DN. + There are quite a few fields but you can leave some blank + For some fields there will be a default value, + If you enter '.', the field will be left blank. + ----- + Country Name (2 letter code) [AU]: + State or Province Name (full name) [Some-State]:Queensland + Locality Name (eg, city) []:Brisbane + Organization Name (eg, company) [Internet Widgits Pty Ltd]:Docker Inc + Organizational Unit Name (eg, section) []:Boot2Docker + Common Name (e.g. server FQDN or YOUR name) []:your.host.com + Email Address []:Sven@home.org.au Now that we have a CA, you can create a server key and certificate signing request. Make sure that "Common Name (e.g. server FQDN or YOUR name)" matches the hostname you will use to connect to Docker: $ openssl genrsa -des3 -out server-key.pem 2048 - $ openssl req -subj '/CN=**<Your Hostname Here>**' -new -key server-key.pem -out server.csr + Generating RSA private key, 2048 bit long modulus + ......................................................+++ + ............................................+++ + e is 65537 (0x10001) + Enter pass phrase for server-key.pem: + Verifying - Enter pass phrase for server-key.pem: + $ openssl req -subj '/CN=<Your Hostname Here>' -new -key server-key.pem -out server.csr + Enter pass phrase for server-key.pem: -Next we're going to sign the key with our CA: +Next, we're going to sign the key with our CA: $ openssl x509 -req -days 365 -in server.csr -CA ca.pem -CAkey ca-key.pem \ -out server-cert.pem + Signature ok + subject=/CN=your.host.com + Getting CA Private Key + Enter pass phrase for ca-key.pem: For client authentication, create a client key and certificate signing request: - $ openssl genrsa -des3 -out client-key.pem 2048 - $ openssl req -subj '/CN=client' -new -key client-key.pem -out client.csr + $ openssl genrsa -des3 -out key.pem 2048 + Generating RSA private key, 2048 bit long modulus + ...............................................+++ + ...............................................................+++ + e is 65537 (0x10001) + Enter pass phrase for key.pem: + Verifying - Enter pass phrase for key.pem: + $ openssl req -subj '/CN=client' -new -key key.pem -out client.csr + Enter pass phrase for key.pem: To make the key suitable for client authentication, create a extensions config file: @@ -59,13 +98,21 @@ config file: Now sign the key: $ openssl x509 -req -days 365 -in client.csr -CA ca.pem -CAkey ca-key.pem \ - -out client-cert.pem -extfile extfile.cnf + -out cert.pem -extfile extfile.cnf + Signature ok + subject=/CN=client + Getting CA Private Key + Enter pass phrase for ca-key.pem: Finally you need to remove the passphrase from the client and server key: $ openssl rsa -in server-key.pem -out server-key.pem - $ openssl rsa -in client-key.pem -out client-key.pem + Enter pass phrase for server-key.pem: + writing RSA key + $ openssl rsa -in key.pem -out key.pem + Enter pass phrase for key.pem: + writing RSA key Now you can make the Docker daemon only accept connections from clients providing a certificate trusted by our CA: @@ -76,32 +123,31 @@ providing a certificate trusted by our CA: To be able to connect to Docker and validate its certificate, you now need to provide your client keys, certificates and trusted CA: - $ docker --tlsverify --tlscacert=ca.pem --tlscert=client-cert.pem --tlskey=client-key.pem \ - -H=dns-name-of-docker-host:2376 + $ docker --tlsverify --tlscacert=ca.pem --tlscert=cert.pem --tlskey=key.pem \ + -H=dns-name-of-docker-host:2376 version > **Note**: > Docker over TLS should run on TCP port 2376. > **Warning**: -> As shown in the example above, you don't have to run the -> `docker` client with `sudo` or -> the `docker` group when you use certificate -> authentication. That means anyone with the keys can give any -> instructions to your Docker daemon, giving them root access to the -> machine hosting the daemon. Guard these keys as you would a root -> password! +> As shown in the example above, you don't have to run the `docker` client +> with `sudo` or the `docker` group when you use certificate authentication. +> That means anyone with the keys can give any instructions to your Docker +> daemon, giving them root access to the machine hosting the daemon. Guard +> these keys as you would a root password! -## Secure By Default +## Secure by default -If you want to secure your Docker client connections by default, you can move the files -to the `.docker` directory in your home directory. Set the `DOCKER_HOST` variable as well. +If you want to secure your Docker client connections by default, you can move +the files to the `.docker` directory in your home directory - and set the +`DOCKER_HOST` variable as well. $ cp ca.pem ~/.docker/ca.pem - $ cp client-cert.pem ~/.docker/cert.pem - $ cp client-key.pem ~/.docker/key.pem + $ cp cert.pem ~/.docker/cert.pem + $ cp key.pem ~/.docker/key.pem $ export DOCKER_HOST=tcp://:2376 -Then you can just run docker with the `--tlsverify` option. +Then you can run Docker with the `--tlsverify` option. $ docker --tlsverify ps @@ -124,5 +170,10 @@ Docker in various other modes by mixing the flags. - tlsverify, tlscacert, tlscert, tlskey: Authenticate with client certificate, authenticate server based on given CA -The client will send its client certificate if found, so you just need -to drop your keys into ~/.docker/<ca, cert or key>.pem +If found, the client will send its client certificate, so you just need +to drop your keys into `~/.docker/<ca, cert or key>.pem`. Alternatively, +if you want to store your keys in another location, you can specify that +location using the environment variable `DOCKER_CONFIG`. + + $ export DOCKER_CERT_PATH=${HOME}/.docker/zone1/ + $ docker --tlsverify ps diff --git a/docs/sources/articles/using_supervisord.md b/docs/sources/articles/using_supervisord.md index 9188265199..10f32c7d1b 100644 --- a/docs/sources/articles/using_supervisord.md +++ b/docs/sources/articles/using_supervisord.md @@ -28,18 +28,14 @@ new image. FROM ubuntu:13.04 MAINTAINER examples@docker.com - RUN echo "deb http://archive.ubuntu.com/ubuntu precise main universe" > /etc/apt/sources.list - RUN apt-get update - RUN apt-get upgrade -y ## Installing Supervisor We can now install our SSH and Apache daemons as well as Supervisor in our container. - RUN apt-get install -y openssh-server apache2 supervisor - RUN mkdir -p /var/run/sshd - RUN mkdir -p /var/log/supervisor + RUN apt-get update && apt-get install -y openssh-server apache2 supervisor + RUN mkdir -p /var/lock/apache2 /var/run/apache2 /var/run/sshd /var/log/supervisor Here we're installing the `openssh-server`, `apache2` and `supervisor` |