- 使用带密码的密钥，通过配置ssh-agent，使用docker context访问远程Docker Engine
环境
Docker Engine: 192.168.17.128 EngineHost
Docker Cli: 192.168.17.129 CliHost
以非root用户身份管理Docker
- 在EngineHost上创建普通用户并添加进docker组
[root@EngineHost ~]# useradd testuser
[root@EngineHost ~]# usermod -aG docker testuser
- 在CliHost上生成ssh key，EngineHost配置密钥登陆
[root@CliHost ~]# ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
Created directory '/root/.ssh'.
Enter passphrase (empty for no passphrase): 【此处输入密码】
Enter same passphrase again: 【此处输入密码】
Your identification has been saved in /root/.ssh/id_rsa
Your public key has been saved in /root/.ssh/id_rsa.pub
The key fingerprint is:
SHA256:1K5jexu43UckpNhRy9WtICiOtmgavysFhm90P+oib+Q root@CliHost
The key's' randomart image is:
+---[RSA 3072]----+
| . .. ...|
| . ..o.oo o|
|. o ..o.=o. . |
|o.. + ....o . o |
|.+ + o S . o |
|. B . o o . |
| X . .= . . |
|+ E . . =.o . |
| =+=. o.o... |
+----[SHA256]-----+
[root@CliHost ~]# ssh-copy-id testuser@EngineHost
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
The authenticity of host 'enginehost (192.168.17.128)' can't be established.
ED25519 key fingerprint is SHA256:gpuL4EePK1eJYGtKQ72MAuRzqiQGywQUXia7953sdbw.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
testuser@enginehost's password:
Number of key(s) added: 1
Now try logging into the machine, with: "ssh 'testuser@EngineHost'"
and check to make sure that only the key(s) you wanted were added.
[root@CliHost ~]#
创建docker context
[root@CliHost ~]# docker context create --docker host=ssh://testuser@EngineHost --description="Remote engine" my-remote-engine
my-remote-engine
Successfully created context "my-remote-engine"
[root@CliHost ~]# docker context use my-remote-engine
my-remote-engine
Current context is now "my-remote-engine"
创建ssh-agent
[root@CliHost ~]# ssh-keyscan EngineHost >> ~/.ssh/known_hosts
# EngineHost:22 SSH-2.0-OpenSSH_8.7
# EngineHost:22 SSH-2.0-OpenSSH_8.7
# EngineHost:22 SSH-2.0-OpenSSH_8.7
# EngineHost:22 SSH-2.0-OpenSSH_8.7
# EngineHost:22 SSH-2.0-OpenSSH_8.7
[root@CliHost ~]# cat .ssh/config
Host EngineHost
HostName EngineHost
User testuser
Port 22
IdentityFile ~/.ssh/id_rsa
ControlMaster auto
ControlPath ~/.ssh/control-%C
ControlPersist yes
[root@CliHost ~]# eval `ssh-agent`
Agent pid 13254
[root@CliHost ~]# ssh-add -l
The agent has no identities.
[root@CliHost ~]# ssh-add ~/.ssh/id_rsa
Enter passphrase for /root/.ssh/id_rsa:
Identity added: /root/.ssh/id_rsa (root@CliHost)
使用ssh登录远程Docker Engine
[root@CliHost ~]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
[root@CliHost ~]# systemctl status docker.service
Unit docker.service could not be found.
[root@CliHost ~]# docker info
Client: Docker Engine - Community
Version: 26.1.4
Context: my-remote-engine
Debug Mode: false
Tips
[root@EngineHost ~]# egrep -v "^#|^$" /usr/lib/systemd/system/docker.service
[Service]
…………
ExecStart=/usr/bin/dockerd -H tcp://0.0.0.0:8888 -H fd:// --containerd=/run/containerd/containerd.sock
…………
[root@EngineHost ~]# systemctl daemon-reload
[root@EngineHost ~]# systemctl restart docker.service
[root@EngineHost ~]# ss -anpt | grep dockerd
LISTEN 0 4096 *:8888 *:* users:(("dockerd",pid=2273,fd=3))
[root@CliHost ~]# export DOCKER_HOST="tcp://EngineHost:8888"
[root@CliHost ~]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
