3 ms·

Docker api exposed over internet without TLS implies a head should be removed. That’s not the default config. Not what the docs recommend. Why??

• djsumdog 8y ago
  I don't think that's even possible. Docker doesn't let you expose the daemon over HTTP without configuring certs. I had to write an ansible script to do that, and even then I locked down my Docker port to my VPN subnet: https://github.com/sumdog/bee2/blob/master/ansible/roles/docker/tasks/servertls.yml https://github.com/sumdog/bee2/blob/master/ansible/roles/doc...
  • toopsss 8y ago
    What the heck are you talking about? If dockerd is started in tcp mode, it is unencrypted and unauthenticated by default.
  • cyphar 8y ago
    sudo dockerd -H tcp://0.0.0.0:8080 will happily start Docker with it listening on my IP address without TLS. It will print an all-caps warning, but nothing else (you don't even need to pass a --give-the-internet-root-access flag). However, I just submitted a PR which adds the --give-the-internet-root-access flag[1] because it's pretty obvious to me that very few users do this intentionally (and with full knowledge of the consequences). [1]: https://github.com/moby/moby/pull/37299 https://github.com/moby/moby/pull/37299