Remote Docker management with certificate authentication and client certificate revocation checks

Introduction

This project helps you set up a TLS connection to the Docker Remote API with certificate authentication and client certificate revocation checking. The server's operating system is Windows Server 1803+.

Remote Docker management

For remote management, Docker can expose a web API. This API can either require no authentication at all (which is strongly discouraged) or use certificate authentication. The problem is that the built-in certificate authentication doesn't check whether a certificate has been revoked. And that can become a problem.

Building the Docker image

To build the image we need the public certificate of the certification authority (ca.cer) that will issue certificates to users. This certificate will be installed into the trusted root certification authorities of the container that runs our proxy. It's needed for the certificate validation procedure.

I didn't bother writing a Dockerfile that builds the application itself. So you have to build it yourself. From the folder with the dockerfile, run:

dotnet publish -c Release -o ..\publish .\DockerTLS\DockerTLS.csproj

By now we should have: Dockerfile, publish, ca.cer. Build the image:

docker build -t vitaliyorg.azurecr.io/docker/proxy:1809 .
docker push vitaliyorg.azurecr.io/docker/proxy:1809

Of course, the image name can be anything.

Running

To run the container we'll need the server certificate certificate.pfx and a file with its password, password.txt. The entire content of the file is treated as the password, so there must be no extra line breaks. Let's say all this stuff lives in the c:\data folder on the server where Docker is installed.

On the same server, run:

docker run --name docker-proxy -d -v "c:/data:c:/data" -v \\.\pipe\docker_engine:\\.\pipe\docker_engine --restart always -p 2376:2376 vitaliyorg.azurecr.io/docker/proxy:1809

Logging

With docker logs you can see who did what. You can also see failed connection attempts there.

Code

Everything you need can be downloaded here