Configure your Docker EngineEstimated reading time: 2 minutes
These are the docs for DTR version 2.0
To select a different version, use the selector below.
By default Docker Engine uses TLS when pushing and pulling images to an image registry like Docker Trusted Registry.
If DTR is using the default configurations or was configured to use self-signed certificates, you need to configure your Docker Engine to trust DTR. Otherwise, when you try to login or push and pull images to DTR, you’ll get an error:
$ docker login <dtr-domain-name> x509: certificate signed by unknown authority
The first step to make your Docker Engine trust the certificate authority used by DTR is to get the DTR CA certificate. Then you configure your operating system to trust that certificate.
Configure your host
# Download the DTR CA certificate $ curl -k https://<dtr-domain-name>/ca -o /usr/local/share/ca-certificates/<dtr-domain-name>.crt # Refresh the list of certificates to trust $ sudo update-ca-certificates # Restart the Docker daemon $ sudo service docker restart
# Download the DTR CA certificate $ sudo curl -k https://<dtr-domain-name>/ca -o /etc/pki/ca-trust/source/anchors/<dtr-domain-name>.crt # Refresh the list of certificates to trust $ sudo update-ca-trust # Restart the Docker daemon $ sudo /bin/systemctl restart docker.service
Login into the virtual machine with ssh:
docker-machine ssh <machine-name>
bootsync.shfile, and make it executable:
sudo touch /var/lib/boot2docker/bootsync.sh sudo chmod 755 /var/lib/boot2docker/bootsync.sh
Add the following content to the
bootsync.shfile. You can use nano or vi for this.
#!/bin/sh cat /var/lib/boot2docker/server.pem >> /etc/ssl/certs/ca-certificates.crt
Add the DTR CA certificate to the
curl -k https://<dtr-domain-name>/ca | sudo tee -a /var/lib/boot2docker/server.pem
bootsync.shand restart the Docker daemon:
sudo /var/lib/boot2docker/bootsync.sh sudo /etc/init.d/docker restart
Login into DTR
To validate that your Docker daemon trusts DTR, trying authenticating against DTR.
$ docker login <dtr-domain-name>