• 使用带密码的密钥，通过配置ssh-agent，使用docker context访问远程Docker Engine

环境

Docker Engine: 192.168.17.128 EngineHost
Docker Cli:    192.168.17.129 CliHost

以非root用户身份管理Docker

• 在EngineHost上创建普通用户并添加进docker组

[root@EngineHost ~]# useradd testuser
[root@EngineHost ~]# usermod -aG docker testuser

• 在CliHost上生成ssh key，EngineHost配置密钥登陆

[root@CliHost ~]# ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
Created directory '/root/.ssh'.
Enter passphrase (empty for no passphrase):  【此处输入密码】
Enter same passphrase again:  【此处输入密码】
Your identification has been saved in /root/.ssh/id_rsa
Your public key has been saved in /root/.ssh/id_rsa.pub
The key fingerprint is:
SHA256:1K5jexu43UckpNhRy9WtICiOtmgavysFhm90P+oib+Q root@CliHost
The key's' randomart image is:
+---[RSA 3072]----+
|         . .. ...|
|      . ..o.oo  o|
|.    o ..o.=o. . |
|o.. + ....o . o  |
|.+ + o  S .  o   |
|. B . o  o    .  |
| X   . .= .  .   |
|+ E .  . =.o  .  |
| =+=.   o.o...   |
+----[SHA256]-----+
[root@CliHost ~]# ssh-copy-id testuser@EngineHost
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
The authenticity of host 'enginehost (192.168.17.128)' can't be established.
ED25519 key fingerprint is SHA256:gpuL4EePK1eJYGtKQ72MAuRzqiQGywQUXia7953sdbw.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
testuser@enginehost's password:

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh 'testuser@EngineHost'"
and check to make sure that only the key(s) you wanted were added.

[root@CliHost ~]#

创建docker context

[root@CliHost ~]# docker context create --docker host=ssh://testuser@EngineHost --description="Remote engine" my-remote-engine
my-remote-engine
Successfully created context "my-remote-engine"
[root@CliHost ~]# docker context use my-remote-engine
my-remote-engine
Current context is now "my-remote-engine"

创建ssh-agent

[root@CliHost ~]# ssh-keyscan EngineHost >> ~/.ssh/known_hosts
# EngineHost:22 SSH-2.0-OpenSSH_8.7
# EngineHost:22 SSH-2.0-OpenSSH_8.7
# EngineHost:22 SSH-2.0-OpenSSH_8.7
# EngineHost:22 SSH-2.0-OpenSSH_8.7
# EngineHost:22 SSH-2.0-OpenSSH_8.7
[root@CliHost ~]# cat .ssh/config
Host EngineHost
    HostName EngineHost
    User testuser
    Port 22
    IdentityFile ~/.ssh/id_rsa
    ControlMaster     auto
    ControlPath       ~/.ssh/control-%C
    ControlPersist    yes

[root@CliHost ~]# eval `ssh-agent`
Agent pid 13254
[root@CliHost ~]# ssh-add -l
The agent has no identities.
[root@CliHost ~]# ssh-add ~/.ssh/id_rsa
Enter passphrase for /root/.ssh/id_rsa:
Identity added: /root/.ssh/id_rsa (root@CliHost)

使用ssh登录远程Docker Engine

[root@CliHost ~]# docker ps
CONTAINER ID   IMAGE     COMMAND   CREATED   STATUS    PORTS     NAMES
[root@CliHost ~]# systemctl status docker.service
Unit docker.service could not be found.
[root@CliHost ~]# docker info
Client: Docker Engine - Community
 Version:    26.1.4
 Context:    my-remote-engine
 Debug Mode: false

Tips

• 开启Engine的API访问

[root@EngineHost ~]# egrep -v "^#|^$" /usr/lib/systemd/system/docker.service
[Service]
…………
ExecStart=/usr/bin/dockerd -H tcp://0.0.0.0:8888 -H fd:// --containerd=/run/containerd/containerd.sock
…………
[root@EngineHost ~]# systemctl daemon-reload
[root@EngineHost ~]# systemctl restart docker.service
[root@EngineHost ~]# ss -anpt | grep dockerd
LISTEN 0      4096                *:8888            *:*    users:(("dockerd",pid=2273,fd=3))

• CliHost直接访问 不安全

[root@CliHost ~]# export DOCKER_HOST="tcp://EngineHost:8888"
[root@CliHost ~]# docker ps
CONTAINER ID   IMAGE     COMMAND   CREATED   STATUS    PORTS     NAMES