Even on systems without systemd it should provide enough details to secure Docker. If you are only interested in securing Docker itself and not Docker Swarm then this should apply to any server with Docker installed that uses systemd.

I will assume you already have a CoreOS server running as described in my Docker Swarm post. Here I will detail what is required to secure Docker (and in turn Docker Swarm) running on a CoreOS server. While not providing fine grained access permissions it does at least allow us to listen on a TCP socket and restrict access with a bonus of also providing encryption. When set up correctly it will only allow clients/servers with a certificate signed by a specific CA to talk to eachother. However if you wish to use the Docker API over TCP then you’ll want to secure it so that you don’t give out root access to anyone that happens to poke you on the TCP port.ĭocker supports using TLS certificates (both on the server and the client) to provide proof of identity. This is fine for the basic use case of the default behavior of only accessing the Docker API on the local machine via the socket as the root user. By default Docker (and by extension Docker Swarm) has no authentication or authorization on its API, relying instead on the filesystem security of its unix socket /var/run/docker.sock which by default is only accessible by the root user.

Docker ssl certificates