docker/docs
1
0
Fork 0
mirror of https://github.com/docker/docs.git synced 2026-11-05 00:14:17 +03:00
Code Activity

Update the API docs about repo namespace to include the word 'owner'

Browse Source 
Signed-off-by: cyli <cyli@twistedmatrix.com>
This commit is contained in:
cyli
2016-06-08 01:00:41 -07:00
parent 0f5f18a213
commit 8ca6f99d5e
1 changed files with 13 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files

68
configure/config-general.md
View File

@@ -31,64 +31,22 @@ match the current certificate, a new self-signed certificate is generated
for the new domain. This also works with IP addresses.
## Configure Notary
## Docker Content Trust
> **Note**: The Trusted Registry's integration of Docker Notary is an experimental feature. The use of a Notary server with Trusted Registry is not officially supported.
The Trusted Registry's includes integration with of Docker Notary to provide
Content Trust functionality, allowing your organization to push and pull
trusted images. After pushing images in the Trusted Registry, you can see
which image tags were signed by viewing the appropriate repositories through
Trusted Registry's web interface.
To use Docker Notary, first deploy your own Notary server and then integrate
with your Trusted Registry through the Settings page. Then, you'll need to
configure your Docker clients to use trust. The Trusted Registry proxies
requests to Notary, so you don't need to explicitly trust Notary's certificate
from the docker client.
Once you enable Notary integration and configure your Docker clients, your
organization can push and pull trusted images. After pushing images in this
configuration to the Trusted Registry, you can see which image tags were signed
by viewing the appropriate repositories through Trusted Registry's web
interface.
To deploy a Notary server follow the instructions at [Deploying
Notary](/engine/security/trust/deploying_notary.md). You can deploy a Notary
server on the same machine as the Trusted Registry. If you do this, you can
connect to the Notary server directly using the IP address of the `docker0`
interface. The interface's address is typically `172.17.42.1`. Read more about
[Docker Networking](/engine/userguide/networking/index.md) to learn about the
`docker0` interface. You can also connect using the machine's external IP
address and port combination provided you expose the proper port.
Once you've deployed your Notary server, do the following:
1. Return to the Trusted Registry in your browser and configure the following
options:
* *Notary Server*: This is the domain name or IP address where you deployed the Notary server.
* *Notary Verify TLS*: This is off by default and you should verify that your connection to Notary works with this turned off before trying to enable it. If Notary's certificate is signed by a public Certificate Authority, you can turn this on and it should work given that the domain name (or IP) matches the one in the certificate.
* *Notary TLS Root CA*: If you don't use a publicly signed certificate but still want to have a secure connection between
the Trusted Registry and Notary, then put the root Certificate Authority's certificate in this field. You can also use a self signed certificate at this location.
2. Once you've configured the Notary settings, save them. After you save, the
Trusted Registry tries to connect to Notary to confirm that the address is
correct. It configures itself as a reverse proxy to the Notary server to make it
easier for clients to automatically use the correct Notary server.
3. Configure your Docker client to use content trust operations.
To configure your Docker client to be able to push signed images to Docker
Trusted Registry refer to the CLI Reference's [Environment Variables
Section](/engine/reference/commandline/cli.md#environment-variables) and
[Notary Section](/engine/reference/commandline/cli.md#notary).
This requires you to set the `DOCKER_CONTENT_TRUST` variable and configure
your system to trust Docker Trusted Registry's TLS certificate if it doesn't
already.
4. Use a client to push an image with trust.
5. Verify the image is signed by visiting the image repository's page through
the Trusted Registry interface.
To configure your Docker client to be able to push signed images to Docker
Trusted Registry refer to the CLI Reference's [Environment Variables
Section](/engine/reference/commandline/cli.md#environment-variables) and
[Notary Section](/engine/reference/commandline/cli.md#notary).
This requires you to set the `DOCKER_CONTENT_TRUST` variable and configure
your system to trust Docker Trusted Registry's TLS certificate if it doesn't
already.
## See also