From 8ca6f99d5efd3f20b4b88ed488f933d9bd4a00a8 Mon Sep 17 00:00:00 2001 From: cyli Date: Wed, 8 Jun 2016 01:00:41 -0700 Subject: [PATCH] Update the API docs about repo namespace to include the word 'owner' Signed-off-by: cyli --- configure/config-general.md | 68 +++++++------------------------------ 1 file changed, 13 insertions(+), 55 deletions(-) diff --git a/configure/config-general.md b/configure/config-general.md index d603c3256e..62ed898867 100644 --- a/configure/config-general.md +++ b/configure/config-general.md @@ -31,64 +31,22 @@ match the current certificate, a new self-signed certificate is generated for the new domain. This also works with IP addresses. -## Configure Notary +## Docker Content Trust -> **Note**: The Trusted Registry's integration of Docker Notary is an experimental feature. The use of a Notary server with Trusted Registry is not officially supported. +The Trusted Registry's includes integration with of Docker Notary to provide +Content Trust functionality, allowing your organization to push and pull +trusted images. After pushing images in the Trusted Registry, you can see +which image tags were signed by viewing the appropriate repositories through +Trusted Registry's web interface. -To use Docker Notary, first deploy your own Notary server and then integrate -with your Trusted Registry through the Settings page. Then, you'll need to -configure your Docker clients to use trust. The Trusted Registry proxies -requests to Notary, so you don't need to explicitly trust Notary's certificate -from the docker client. - -Once you enable Notary integration and configure your Docker clients, your -organization can push and pull trusted images. After pushing images in this -configuration to the Trusted Registry, you can see which image tags were signed -by viewing the appropriate repositories through Trusted Registry's web -interface. - -To deploy a Notary server follow the instructions at [Deploying -Notary](/engine/security/trust/deploying_notary.md). You can deploy a Notary -server on the same machine as the Trusted Registry. If you do this, you can -connect to the Notary server directly using the IP address of the `docker0` -interface. The interface's address is typically `172.17.42.1`. Read more about -[Docker Networking](/engine/userguide/networking/index.md) to learn about the -`docker0` interface. You can also connect using the machine's external IP -address and port combination provided you expose the proper port. - -Once you've deployed your Notary server, do the following: - -1. Return to the Trusted Registry in your browser and configure the following -options: - - * *Notary Server*: This is the domain name or IP address where you deployed the Notary server. - - * *Notary Verify TLS*: This is off by default and you should verify that your connection to Notary works with this turned off before trying to enable it. If Notary's certificate is signed by a public Certificate Authority, you can turn this on and it should work given that the domain name (or IP) matches the one in the certificate. - - * *Notary TLS Root CA*: If you don't use a publicly signed certificate but still want to have a secure connection between - the Trusted Registry and Notary, then put the root Certificate Authority's certificate in this field. You can also use a self signed certificate at this location. - -2. Once you've configured the Notary settings, save them. After you save, the -Trusted Registry tries to connect to Notary to confirm that the address is -correct. It configures itself as a reverse proxy to the Notary server to make it -easier for clients to automatically use the correct Notary server. - -3. Configure your Docker client to use content trust operations. - - To configure your Docker client to be able to push signed images to Docker - Trusted Registry refer to the CLI Reference's [Environment Variables - Section](/engine/reference/commandline/cli.md#environment-variables) and - [Notary Section](/engine/reference/commandline/cli.md#notary). - - This requires you to set the `DOCKER_CONTENT_TRUST` variable and configure - your system to trust Docker Trusted Registry's TLS certificate if it doesn't - already. - -4. Use a client to push an image with trust. - -5. Verify the image is signed by visiting the image repository's page through -the Trusted Registry interface. +To configure your Docker client to be able to push signed images to Docker +Trusted Registry refer to the CLI Reference's [Environment Variables +Section](/engine/reference/commandline/cli.md#environment-variables) and +[Notary Section](/engine/reference/commandline/cli.md#notary). +This requires you to set the `DOCKER_CONTENT_TRUST` variable and configure +your system to trust Docker Trusted Registry's TLS certificate if it doesn't +already. ## See also