Docker Swarm and self-signed Docker Registry

Question

Does Docker Swarm support usage of Docker Registry with self-signed certificate?

I've created my cluster based on step from official Docker documentation , it uses swarm master/nodes running inside containers.

It works well, but as soon as I try to login to my Docker Registry I'm getting error message:

$ docker -H :4000 login https://...:443
...
Error response from daemon: Get https://.../v1/users/: x509: certificate signed by unknown authority

Is there an additional option which needs to be set, like --insecure-registry ? Or do I need to somehow update Docker Swarm container?

Answer 1

You need to add your self signed cert or personal CA to the list of trusted certificates on the host. For some reason, docker doesn't use the certificates on the daemon for this authentication. Here are the commands for a debian host:

sudo mkdir -p /usr/local/share/ca-certificates
sudo cp ca.pem /usr/local/share/ca-certificates/ca-local.crt
sudo update-ca-certificates
sudo systemctl restart docker

The docker restart at the end is required for the daemon to reload the OS certificates.

As luka5z saw in the latest documentation , you can also add the certs directly to each docker engine by copying the cert to /etc/docker/certs.d/myregistrydomain.com:5000/ca.crt . This avoids trusting the self signed CA on the entire OS.

Answer 2

is there a way I could update it with required certificates?

Docker 17.06 will bring the command docker swarm ca ( PR 48 ).
Meaning a docker swarm ca --rotate will be enough.

root@ubuntu:~# docker swarm ca --help

Usage:  docker swarm ca [OPTIONS]

Manage root CA

Options:
      --ca-cert pem-file          Path to the PEM-formatted root CA certificate to use for the new cluster
      --ca-key pem-file           Path to the PEM-formatted root CA key to use for the new cluster
      --cert-expiry duration      Validity period for node certificates (ns|us|ms|s|m|h) (default 2160h0m0s)
  -d, --detach                    Exit immediately instead of waiting for the root rotation to converge
      --external-ca external-ca   Specifications of one or more certificate signing endpoints
      --help                      Print usage
  -q, --quiet                     Suppress progress output
      --rotate                    Rotate the swarm CA - if no certificate or key are provided, new ones will be generated

Here is a demo .

Answer 3

I also encountered your problem.

I was not able to identify the root cause of this, or what sets this limitation.

But i managed a workaround:

if it is insecure make sure you start each docker daemon accordingly on each host.

you can find info on how to change daemon options: https://docs.docker.com/engine/admin/systemd/

eg: from my conf. --insecure-registry <private registry> after that:

systemctl daemon-reload
systemctl restart docker
docker login <private registry>

on each docker host and pull the needed images.

after that you have all the images and it will not try to pull them anymore.

i know this is not the best solution :(

PS: I also had to add these parameters to each docker daemon:

--cluster-advertise=<host:ip> --cluster-store=consul://<consul ip:consul port>

without these i could not run containers on different hosts. They were all running on one host randomly chosen.