2

I'm running Docker on Windows 10, and I noticed that by default, DOCKER_TLS_VERIFY=0.

I have a few questions about it:

  1. Does it mean that I'm pulling images from Docker Hub insecurly?
  2. Does Docker pull images through https when it is set to 0?
  3. Is it recommended to set it to 1?

2 Answers 2

4

Communication with external registry servers like docker hub will default to TLS, this option is for something very different.

DOCKER_TLS_VERIFY tells the docker client (aka the docker command) whether to communicate with the docker daemon (dockerd) with any TLS verification. If set to 1, the server needs to have a private CA signed key pair, and the client also needs to have a key pair signed by the same CA. This setting tells the client to verify that server key it receives is signed by the private CA. The daemon/server will have a similar setting to verify client certificates.

If you are communicating with a remote docker engine over the network, this would be very bad since it implies that the remote docker engine allows anyone to hit the API (which gives root level access) without any client credentials. When communicating to a local socket that is protected with filesystem permissions, this feature is not needed.

This variable is documented here: https://docs.docker.com/engine/reference/commandline/cli/

Steps to configure the daemon and clients with TLS keys are documented here: https://docs.docker.com/engine/security/https/

For windows, many of the above steps would need to be translated (e.g. different locations for the daemon.json file). Have a look at the following:

https://docs.docker.com/engine/reference/commandline/dockerd/

https://docs.docker.com/docker-for-windows/

2
  • Thank you for your comprehensive answer! Just to clarify, if my Docker daemon is running on the same machine, then I don't need to set it to 1 since it is protected with the filesystem permissions, right?
    – Scooby-Doo
    Feb 5, 2019 at 21:23
  • @Scooby-Doo A default install is secure. If settings have been changed, it matters more whether the server is listening on an internet accessible port without encryption than anything else.
    – BMitch
    Feb 5, 2019 at 21:38
1

It is worth noting that DOCKER_TLS_VERIFY environment variable indicate to verify TLS everytime wheter it is set to any value.: eg 0, 1 or whatever.

Only setting this variable to empty like: export DOCKER_TLS_VERIFY= prevents using TLS with communicating with the dockerd daemon.

It is also worth to repeat @BMitch it is not advised to use unsecured access to your docker deamon and you should use TLS setup.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.