- [Instructor] A relatively new feature
of Docker is the ability to lock your swarm cluster.
This is important because swarm managers
use at rest encryption to secure their log files.
Securing swarm is also important because of the ability
for Docker to store and distribute secret keys
for other applications with the Docker secrets feature.
Any time that the Docker daemon restarts,
the keys used to encrypt communication between nodes
and the keys used to encrypt the logs
on the disc are loaded.
With Docker 1.13 and higher, you have the option
to better protect the encryption keys used
to access the swarm log by having the swarm managers
require you to provide this key
when they're restarted for security reasons.
The Docker documentation provides full details
on exactly how this works,
but let's jump over into a real Docker node
and I'll walk you through it step by step.
If you're creating a brand new Docker swarm cluster,
you can enable autolock when you initialize swarm
with this command: docker swarm init --autolock.
However, in our case,
since we already have a Docker swarm cluster running,
and we have two nodes in that cluster,
we need to use a different command to enable autolock.
To enable autolock on an existing Docker swarm cluster,
you use the command:
docker swarm space update
and then dash dash autolock equals true.
Now notice what it says here.
It says, To unlock a swarm manager after it restarts,
you have to run the the docker swarm unlock command
and you must provide this key.
Which of course will be different
on different docker swarm clusters.
It tells us to make sure that we remember this key
or store it in a password manager
which is more likely considering the length of the key
since you won't be able to restart
your Docker swarm managers without it.
So let's make sure that we copy this key.
We'll put that in our copy buffer.
We don't want to lose that.
And then let's go over to another node in the cluster.
This is node two.
We'll do a Docker node ls.
So this is node two and what we're going to do here
is to do a sudo and run systemctl
and we'll just restart the Docker service.
Alright, Docker's been restarted.
Let's do a Docker node ls.
And there we go.
It tells us that swarm is encrypted
and has to be unlocked before we can use it.
Please use docker swarm unlock to unlock swarm.
So to unlock swarm, we'll run that command.
Docker...
swarm...
Unlock, and then we have to paste in that encryption key
that we copied when we enabled autolock.
And then if we do a docker node ls again,
there we go.
We have unlocked the cluster.
So that's how autolock works.
That's the basics of it.
There's a few commands that you might want to be aware of.
So we have Docker swarm.
And if we do a docker swarm space unlock dash key,
at any time, we can get that key back again
as long as the cluster isn't locked.
If the cluster is locked,
we have to have saved that key off somewhere.
Now something else we can do here is,
if I clear the screen,
there's a docker swarm unlock-key.
Let's do a help.
And you can actually enable rotation.
You can tell it to rotate the key for security reasons.
So let's say we want to rotate our key
and it says we have successfully rotated
the manager unlock key, so here's an updated key.
This is a new key.
Perhaps we storing it in a password manager
and an employee left the company.
Perhaps they know the key, so we want to rotate the key.
That's what we've just done and we have a new key
and now we need to save that key somewhere securely
in case any of our Docker hosts restart
which is going to happen sooner or later
so that we can unlock the Docker swarm cluster
with the Docker swarm unlock key
and the key that we've saved.
So that's how to unlock your Docker swarm cluster
if you're using the autolock functionality.