{"id":609,"date":"2023-03-29T18:54:12","date_gmt":"2023-03-29T10:54:12","guid":{"rendered":"https:\/\/codestrian.com\/?p=609"},"modified":"2023-03-30T14:37:17","modified_gmt":"2023-03-30T06:37:17","slug":"expose-rootless-docker-api-socket-via-tcp-with-ssl","status":"publish","type":"post","link":"https:\/\/codestrian.com\/index.php\/2023\/03\/29\/expose-rootless-docker-api-socket-via-tcp-with-ssl\/","title":{"rendered":"Expose Rootless Docker API socket via TCP with SSL"},"content":{"rendered":"

In my previous write-ups, I explained how to set up rootless Docker, and I also mentioned that I prefer using Portainer to manage my containers. However, to enable Portainer to manage Docker daemons on multiple servers, I need to be able to connect to these daemons and add them as Portainer environments. Exposing the Docker API socket via TCP is one way to achieve this.<\/p>\n

By default, the Docker API socket is only accessible locally on the host machine. However, it is possible to expose the Docker API socket via TCP so that it can be accessed remotely.<\/p>\n

You can configure the Docker daemon to expose the API socket via TCP by adding the following configuration to the daemon.json<\/code> file, which can be found in ~\/.config\/systemd\/docker\/daemon.json<\/code><\/p>\n

{\n  "hosts": ["unix:\/\/\/run\/user\/1001\/docker.sock", "tcp:\/\/0.0.0.0:2375"],\n}<\/code><\/pre>\n
To enable the rootless docker daemon to listen to specific ports, you will need to add the following line to the docker.service<\/code> configuration file located at ~\/.config\/systemd\/user<\/code><\/p>\n
Environment=DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS="-p 0.0.0.0:2375:2375\/tcp"<\/code><\/pre>\n
After making changes to the docker.service configuration file and the daemon.json configuration file, you'll need to reload the daemon and restart the docker service for the changes to take effect. Here are the steps to do so:<\/p>\n
    \n
  1. Reload the daemon by running the command:\n
    systemctl --user daemon-reload<\/code><\/pre>\n<\/li>\n
  2. Restart the docker service by running the command:\n
    systemctl --user restart docker<\/code><\/pre>\n<\/li>\n<\/ol>\n
    However, it is a security risk to expose the Docker API socket via TCP as it allows remote access to the Docker API. Therefore, it is recommended to use TLS encryption and authentication to secure the connection.<\/p>\n
    To enable SSL, you will need to have the CA certificate, server certificate and server key. You may find the instruction on how to generate these files on docker<\/a>.<\/p>\n
    Together with the files above, you will need to update the daemon.json<\/code> as shown below<\/p>\n
    {\n  "hosts": ["unix:\/\/\/run\/user\/1001\/docker.sock", "tcp:\/\/0.0.0.0:2376"],\n  "tlsverify": true,\n  "tlscacert": "\/home\/docker\/.docker\/certs\/ca.crt",\n  "tlscert": "\/home\/docker\/.docker\/certs\/server.crt",\n  "tlskey": "\/home\/docker\/.docker\/certs\/server.key"\n}<\/code><\/pre>\n
    Lastly, change the port from 2375<\/strong> to 2376<\/strong> in docker.service<\/code><\/p>\n
    Environment=DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS="-p 0.0.0.0:2376:2376\/tcp"<\/code><\/pre>\n
    [Unit]\nDescription=Docker Application Container Engine (Rootless)\nDocumentation=https:\/\/docs.docker.com\/go\/rootless\/\n\n[Service]\nEnvironment=PATH=\/usr\/bin:\/sbin:\/usr\/sbin:\/usr\/local\/bin:\/usr\/bin:\/bin:\/usr\/local\/games:\/usr\/games\nEnvironment=DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS="-p 0.0.0.0:2376:2376\/tcp"\nExecStart=\/usr\/bin\/dockerd-rootless.sh\nExecReload=\/bin\/kill -s HUP $MAINPID\nTimeoutSec=0\nRestartSec=2\nRestart=always\nStartLimitBurst=3\nStartLimitInterval=60s\nLimitNOFILE=infinity\nLimitNPROC=infinity\nLimitCORE=infinity\nTasksMax=infinity\nDelegate=yes\nType=notify\nNotifyAccess=all\nKillMode=mixed\n\n[Install]\nWantedBy=default.target<\/code><\/pre>\n
    Just like before, reload the daemon and restart the docker to see the result.<\/p>\n","protected":false},"excerpt":{"rendered":"
    In my previous write-ups, I explained how to set up rootless Docker, and I also mentioned that I prefer using Portainer to manage my containers. However, to enable Portainer to manage Docker daemons on multiple servers, I need to be able to connect to these daemons and add them as […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[62],"tags":[73],"_links":{"self":[{"href":"https:\/\/codestrian.com\/index.php\/wp-json\/wp\/v2\/posts\/609"}],"collection":[{"href":"https:\/\/codestrian.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/codestrian.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/codestrian.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/codestrian.com\/index.php\/wp-json\/wp\/v2\/comments?post=609"}],"version-history":[{"count":6,"href":"https:\/\/codestrian.com\/index.php\/wp-json\/wp\/v2\/posts\/609\/revisions"}],"predecessor-version":[{"id":615,"href":"https:\/\/codestrian.com\/index.php\/wp-json\/wp\/v2\/posts\/609\/revisions\/615"}],"wp:attachment":[{"href":"https:\/\/codestrian.com\/index.php\/wp-json\/wp\/v2\/media?parent=609"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/codestrian.com\/index.php\/wp-json\/wp\/v2\/categories?post=609"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/codestrian.com\/index.php\/wp-json\/wp\/v2\/tags?post=609"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}