Install Docker on Ubuntu and set up remote connection using tls

Install Docker on Ubuntu and set up remote connection using tls

Here also wrote the same article.

1. 1. Docker installation

Execute the following command to install Docker on Ubuntu I try to do everything with one copy and paste so as not to bother me

sudo apt -y install apt-transport-https ca-certificates software-properties-common && \
curl -fsSL | sudo apt-key add - && \
sudo add-apt-repository "deb [arch=amd64] $(lsb_release -cs) stable" && \
sudo apt install -y docker-ce

2. Docker startup settings

Automatically start when the OS starts, and start on the spot

sudo systemctl enable docker
sudo systemctl start docker

3. 3. Operation check

By default you need root privileges to connect to Docker

sudo docker ps

4. Make Docker available to general users

After executing the following command, you can use it by logging in again.

sudo echo usermod -aG docker `logname`


docker ps

5. Connection by tls

From here it will be a troublesome part I need to create an oleore certificate and distribute it to the server and client, but it takes a lot of time and effort to do this. It's too annoying, so I created a script that skips all input in the middle so that it ends with one command

5.1 Creating a certificate

Check here for the command description

Create a certificate to connect remotely

curl -s | \
sudo bash

If you want to set the host name correctly when connecting, specify the domain name and IP as follows.

curl -s | \
sudo bash -s,IP:

5.1.1 Generated file

--Private key /etc/docker/certs/private-key.pem

--File for Docker daemon /etc/docker/certs/ca.pem /etc/docker/certs/server-key.pem /etc/docker/certs/server-cert.pem

--File for client ~/.docker/ca.pem ~/.docker/cert.pem ~/.docker/key.pem

For remote connection in Windows or Mac environment, copy the client file to the .docker folder in the user directory.

5.1.2 Regarding private keys

The certificate auto-generation script is designed to reuse private keys So if you reissue the certificate, you don't have to redistribute the client's certificate. Also, if you create a certificate with the existing private key copied to the same location on another server, you can connect to multiple servers with the same client file.

If you need a complete remake, please erase the private key manually

5.2 Change service settings

--File rewriting Rewrite ** ExecStart ** in ** / lib / systemd / system / docker.service ** as follows This setting will accept TCP connections via tls By the way, if the external public server is set to accept TCP connections without using tls, it may become a Bitcoin manufacturing factory before you know it, so please be careful.

ExecStart=/usr/bin/dockerd --tlsverify --tlscacert=/etc/docker/certs/ca.pem --tlscert=/etc/docker/certs/server-cert.pem --tlskey=/etc/docker/certs/server-key.pem -H tcp:// -H fd:// --containerd=/run/containerd/containerd.sock

--When it is troublesome to edit manually Rewriting is completed by pasting the following command

sudo sed -i "s/^ExecStart=.*/ExecStart=\/usr\/bin\/dockerd \
--tlsverify --tlscacert=\/etc\/docker\/certs\/ca.pem \
--tlscert=\/etc\/docker\/certs\/server-cert.pem \
--tlskey=\/etc\/docker\/certs\/server-key.pem \
-H tcp:\/\/ -H fd:\/\/ \
--containerd=\/run\/containerd\/containerd.sock/" \

5.3 Service updates

sudo systemctl daemon-reload && sudo systemctl restart docker

5.4 Check connection with tls

In the service settings so far, tls connection is required when connecting by addressing using -H. Therefore, you cannot connect unless you specify --tls. If you set --tlsverify, the domain name will be verified when connecting.

docker --tls -H localhost ps
docker --tlsverify -H localhost ps

5.5 Remote Docker image transfer

Docker commands have the ability to pipe Docker images, so you can transfer images remotely without going through Docker Hub by doing the following:

docker save image name(Multiple can be specified) | docker --tls -H server name load

Useful for transferring locally created images or CI / CD builds This makes it easy to deploy small ones

5.6 When connecting from docker-compose

Please note that you cannot connect unless it matches the host name specified when creating the certificate.

docker-compose --tlsverify -H host name:2375 or less Normal command

6. Summary

Once you have issued the certificate, you will be able to easily operate Docker remotely. After that, if you send a container and move it, you will be able to do almost anything However, be careful of mistakes such as putting a certificate in a public repository and publishing it. Publishing creates regret

Recommended Posts

Install Docker on Ubuntu and set up remote connection using tls
Install Docker on Ubuntu Server 20.04
Set up ansible-playbook on Ubuntu 20.04
Install Ubuntu 20.04 in virtual box on windows10 and build a development environment using docker
Install docker and docker-compose on ubuntu in the shortest process
Set up Django on Ubuntu 16.04 with PostgreSQL and Gunicorn on ECS
Install JDK and JRE on Ubuntu 16.10
Install ngrok on ubuntu16.04 using Vagrant
Installing and using Ansible on Ubuntu 16.04
Install Cloud9 on Raspberry pi 4 and set up Rails development environment
Install docker and docker-compose on Alpine Linux
Set up Docker Registry locally on CentOS 7
Build and install Wireshark Development Release (3.3.1) on Ubuntu
Install Docker on Raspberry Pi 4 and Raspberry Pi OS 64bit
Set up an SSH server on WSL2 Ubuntu 20.04
Docker on Ubuntu18.04 on WSL2 and VSCode installation instructions
Creating an SSL certificate using Let's Encrypt and setting up Nginx on Ubuntu 20
Install pyqt5 on ubuntu
Easily build Redmine on Windows using WSL2 and Docker
Ssh to Ubuntu on VirtualBox on your Mac and do it until you install Docker
Install Docker on Manjaro
Install Ruby on Ubuntu 20.04
Steps to set up Postfix and Dovecot on CentOS 8.3
Install java and maven using brew on new mac
I tried using YOLO v4 on Ubuntu and ROS
Install Autoware on Ubuntu 18.04.5
Install rbenv with apt on ubuntu and put ruby
Install Homebrew on Ubuntu 20.04
Set up a MineCraft Paper server on Ubuntu 20.04.1 LTS ② Update
Configuration script for using docker in proxy environment on ubuntu 20.04.1
Using Flutter on Ubuntu (Part 2)
Install Docker on Raspberry Pi
Install Docker on Windows 10 PRO
Install OpenJDK7 (JAVA) on ubuntu 14.04
Install Cybozu Office 10 on Ubuntu 20.4
Latest docker installation (Ubuntu 20.04 and Ubuntu 20.10)
Oracle Java 8 on Docker Ubuntu
Install zabbix agent (5.0) on Ubuntu 18.04
Install MAV Proxy on Ubuntu 18.04
Set up GitLab with docker
Install Arudino IDE on Ubuntu 20
Set up Gitolite on CentOS 7
Install Java on WSL Ubuntu 18.04
Install Ubuntu Desktop 20.10 on RaspberryPi4
Install Arduino IDE on Ubuntu 20.04
Install raspi-config on Ubuntu 20.04 (LTS)
Install docker on AWS EC2
Install WordPress 5.5 on Ubuntu 20.04 LTS
Install PlantUML on Intellij on Ubuntu
Install Ubuntu Server 20.04 on Btrfs
Note: Install PostgreSQL 9.5 on Ubuntu 18.04
How to install and use Composer on an ECS instance on Ubuntu 16.04
Deploy laravel using docker on EC2 on AWS ③ (SSH connection ~ Docke-compose installation)
Install Docker and docker-compose on Raspberry Pi 4, Linux (Debian) and Windows 10, respectively
Easily set up a Jenkins server on AWS using Bitnami's AMI
How to install and configure the monitoring tool "Graphite" on Ubuntu
Install Ubuntu20.04 on RaspberryPi 4 and build Kubernetes to run the container
Set up a Wordpress Docker environment without using the Worpdress image
Install Ubuntu Server 20.04 in VirtualBox on Mac and connect with SSH
Signing and validation using
Animation using matchedGeometryEffect and @Namespace
How to install and configure the monitoring tool "Graphite" on Ubuntu
Install openjdk8 on Docker image (Debian)