Skip to content

Instantly share code, notes, and snippets.

Forked from woudsma/
Last active February 20, 2022 04:06
Show Gist options
  • Save tlongren/e132340598728d698dbfabf461c9016f to your computer and use it in GitHub Desktop.
Save tlongren/e132340598728d698dbfabf461c9016f to your computer and use it in GitHub Desktop.
TLS secured TCP exposed Docker daemon on Dokku host - setup

TLS secured TCP exposed Docker daemon on Dokku host - setup

  1. Create certificates
  2. Edit Docker options
  3. Restart Docker
  4. Copy client certificates from host
  5. (optional) Add remote endpoint in Portainer

Tested on a standard $5/mo DigitalOcean VPS running Ubuntu 16.04.

Create certificates:

Log into Dokku host as root and create server/client certificates:

export HOST=my.domain
mkdir .docker && cd .docker

openssl genrsa -aes256 -out ca-key.pem 4096
openssl req -new -x509 -days 365 -key ca-key.pem -sha256 -out ca.pem
openssl genrsa -out server-key.pem 4096
openssl req -subj "/CN=$HOST" -sha256 -new -key server-key.pem -out server.csr
echo subjectAltName = DNS:$HOST,IP: >> extfile.cnf
echo extendedKeyUsage = serverAuth >> extfile.cnf
openssl x509 -req -days 365 -sha256 -in server.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out server-cert.pem -extfile extfile.cnf
openssl genrsa -out key.pem 4096
openssl req -subj '/CN=client' -new -key key.pem -out client.csr
echo extendedKeyUsage = clientAuth >> extfile.cnf
openssl x509 -req -days 365 -sha256 -in client.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out cert.pem -extfile extfile.cnf
rm client.csr server.csr
chmod 0400 ca-key.pem key.pem server-key.pem
chmod 0444 ca.pem server-cert.pem cert.pem

(please comment if you know how this can be done easier 😭)
For more details refer to the documentation

Edit Docker options:

systemctl edit docker


ExecStart=/usr/bin/dockerd -H tcp:// --tlsverify --tlscacert /root/.docker/ca.pem --tlscert /root/.docker/server-cert.pem --tlskey /root/.docker/server-key.pem -H unix:///var/run/docker.sock

(note: -H unix:///var/run/docker.sock as last argument!)
Creates /etc/systemd/system/docker.service.d/.#override.conf3aa8ba90533acd64
For more details refer to the documentation

Restart Docker:

systemctl restart docker

Copy certificates from host:

Exit host: exit
SFTP into host: sftp root@host

cd .docker
get ca.pem
get cert.pem
get key.pem

Guard these keys like root passwords, malicious users can severely damage your server with access to the Docker daemon.

Add endpoint in Portainer

Provide my.domain:2376, enable TLS and add ca.pem, cert.pem and key.pem

If Portainer can't connect to the endpoint, most likely something went wrong while creating the certificates. Check out the documentation and re-generate the certificates.

# Check if the Docker daemon is running
docker -H my.domain:2376 info

# Check if the DNS settings are correct
dig +short my.domain

Run Portainer on Dokku host

Running Portainer as a container management tool for other Dokku hosts.

dokku apps:create portainer
dokku domains:add portainer

Create persistent storage folder: mkdir -p /var/lib/dokku/data/storage/portainer
Edit app docker-options:

dokku docker-options:add portainer deploy,run "-v /var/lib/dokku/data/storage/portainer:/data -v /var/run/docker.sock:/var/run/docker.sock"


mkdir portainer && cd portainer
git init
git remote add dokku dokku@<host>:portainer
curl > .gitignore
touch Dockerfile

Edit Dockerfile:

FROM  portainer/portainer-ce:2.11.1

Push to Dokku host:

git add .
git commit -m 'initial'
git push dokku master

Map ports and add SSL using dokku-letsencrypt:

# Map ports
dokku ps:stop portainer
dokku config:set portainer DOKKU_PROXY_PORT_MAP="http:80:9000"

# Add SSL
dokku config:set --no-restart portainer DOKKU_LETSENCRYPT_EMAIL=your@email.tld
dokku letsencrypt:enable portainer

# Check if ports are mapped correctly
dokku config:get portainer DOKKU_PROXY_PORT_MAP

# Should output: "http:80:9000 https:443:9000"

To re-deploy Portainer, first stop the Portainer container (it's using the Docker socket) dokku ps:stop portainer

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment