- [Instructor] In the Docker Certified Associate
Exam Study Guide, underneath domain three,
Installation and Configuration,
it says that you should know how to use certificate-based,
client-server authentication to ensure a Docker daemon
has the rights to access images on a registry.
And instead of covering this topic over
in my Installation and Configuration course,
I chose to instead,
talk about it in this Docker Security course
because I think it makes more sense.
So if you take a look at a simple
Docker architecture diagram here,
you have in the middle the Docker daemon,
and that's of course where you're running your containers
that are based on images.
The client is what's initiating all of that to happen,
whether it's a build command or running a container,
or stopping a service or starting a service,
that's all initiated by the client that's talking
to the Docker daemon.
If you look on the right-hand side of the diagram,
then we have the registry.
So the registry is what stores our images,
our container images.
And if you think about it,
really the Docker daemon is a client of the registry.
So if you use TLS to secure the Docker daemon
and you download a client bundle
which allows you to access the Docker daemon securely,
you also need to think about securing Docker daemon
to registry communication.
In fact in the Docker reference architecture
where they talk about securing Docker enterprise edition
and security best practices,
which by the way is a fantastic guide
when it comes to Docker security,
they have a section here called DTR Security.
If we click on DTR Security,
it talks about how Docker trusted registry
of course offers secure signing
via the notary project and image scanning,
which we talk about in this course.
It also shares authentication
with the universal control plane, or UCP,
so that you can configure role-based access control,
but what they point out down here is if you scroll down,
in production environments,
it's recommended to use a fully signed company certificate
or a self-signed certificate,
to secure Docker trusted registry.
At most companies they have
a certificate authority, internal,
or they're using an external certificate authority,
and they talk about the process here
to add a certificate to Docker trusted registry,
so that communication to and from DTR will be secure.
If we go over into Docker trusted registry,
to configure TLS you go into System,
and then we're here on the General tab by default.
If we scroll down, right here underneath Domains and proxies
this is the section that you need to concern yourself with.
Now first off here they have the load balancer
or public IP address.
This is the domain name that clients will use
to access DTR.
And I actually have configured here
the current IP address of the host
where the Docker trusted registry container is running.
That way the self-signed certificate will actually work
with some of the other services
that we've been configuring here,
such as image scanning.
But if you click on the show TLS settings right here,
this is where you would enter your TLS private key,
that's the server private key.
The TLS certificate chain.
This is issued by the certificate authority,
and then the TLS root chain.
This is used to create your TLS certificate
and then you would simply click Save, right here.
So that's how easy it is to configure,
TLS on Docker trusted registry,
to ensure security between Docker
and Docker trusted registry.