docker
/
docs
mirror of https://github.com/docker/docs.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Remove some references to enterprise products 

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This commit is contained in:
Sebastiaan van Stijn 2020-07-02 23:15:57 +02:00
parent 589741684d
commit 2b4833a355
No known key found for this signature in database
GPG Key ID: 76698F39D527CE8C
17 changed files with 100 additions and 161 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
_data/glossary.yaml
View File

@ -77,10 +77,6 @@
develop, ship, and run applications develop, ship, and run applications
- The docker daemon process running on the host which manages images and containers - The docker daemon process running on the host which manages images and containers
(also called Docker Engine) (also called Docker Engine)
<a class="glossary" name="docker_enterprise">Docker Enterprise</a>: |
Docker Enterprise is a platform to build, ship, and run containerized applications, that
you can deploy in the cloud or on-premise. It includes a tested and certified version of Docker,
web UIs for managing your app resources, and support.
<a class="glossary" name="docker_desktop_for_mac">Docker Desktop for Mac</a>: | <a class="glossary" name="docker_desktop_for_mac">Docker Desktop for Mac</a>: |
[Docker Desktop for Mac](/docker-for-mac/) is an easy-to-install, lightweight [Docker Desktop for Mac](/docker-for-mac/) is an easy-to-install, lightweight
Docker development environment designed specifically for the Mac. A native Docker development environment designed specifically for the Mac. A native

4
_includes/enterprise_label_shortform.md
View File

@ -1,4 +0,0 @@
<!-- This text will be included on all Docker pages that document Enterprise products, features, and technologies that are transitioning to Mirantis. -->
This topic applies to Docker Enterprise.
>
>The Docker Enterprise platform business, including products, customers, and employees, has been acquired by Mirantis, inc., effective 13-November-2019. For more information on the acquisition and how it may affect you and your business, refer to the [Docker Enterprise Customer FAQ](https://www.docker.com/faq-for-docker-enterprise-customers-and-partners).

28
app/working-with-app.md
View File

@ -24,7 +24,7 @@ With Docker App, entire applications can now be managed as easily as images and
Docker App lets you _build_, _validate_ and _deploy_ applications with the `docker app` command. You can Docker App lets you _build_, _validate_ and _deploy_ applications with the `docker app` command. You can
even leverage secure supply-chain features such as signed `push` and `pull` operations. even leverage secure supply-chain features such as signed `push` and `pull` operations.
> **NOTE**: `docker app` works with `Engine - Community 19.03` or higher and `Engine - Enterprise 19.03` or higher. > **NOTE**: `docker app` works with `Docker 19.03` or higher.
This guide walks you through two scenarios: This guide walks you through two scenarios:
@ -42,7 +42,7 @@ This section describes the steps for creating a new Docker App project to famili
1. Populate the project 1. Populate the project
1. Validate the app 1. Validate the app
1. Deploy the app 1. Deploy the app
1. Push the app to Docker Hub or Docker Trusted Registry 1. Push the app to Docker Hub
1. Install the app directly from Docker Hub 1. Install the app directly from Docker Hub
### Prerequisites ### Prerequisites
@ -394,27 +394,7 @@ $ docker login
$ docker app push my-app --platform="linux/amd64" --tag <hub-id>/<repo>:0.1.0 $ docker app push my-app --platform="linux/amd64" --tag <hub-id>/<repo>:0.1.0
``` ```
### Push the app to DTR ### Install the app directly from Docker Hub
Pushing an app to Docker Trusted Registry (DTR) involves the same procedure as
[pushing an app to Docker Hub](#push-the-app-to-docker-hub) except that you
need your DTR user credentials and [your DTR repository
information](/ee/dtr/user/manage-images/review-repository-info/). To use client
certificates for DTR authentication, see [Enable Client Certificate
Authentication](/ee/enable-client-certificate-authentication/).
By default, all platform architectures are pushed to DTR. If you are pushing an
official Docker image as part of your app, you may find your app bundle
becomes large with all image architectures embedded. To just push the
architecture required, you can add the `--platform` flag.
```bash
$ docker login dtr.example.com
$ docker app push my-app --platform="linux/amd64" --tag dtr.example.com/<user>/<repo>:0.1.0
```
### Install the app directly from Docker Hub or DTR
Now that the app is pushed to the registry, try an `inspect` and `install` command against it. Now that the app is pushed to the registry, try an `inspect` and `install` command against it.
The location of your app is different from the one provided in the examples. The location of your app is different from the one provided in the examples.
@ -433,7 +413,7 @@ hello.port 8080
hello.text Hello world! hello.text Hello world!
``` ```
This action was performed directly against the app in the registry. Note that for DTR, the application will be prefixed with the Fully Qualified Domain Name (FQDN) of your trusted registry. This action was performed directly against the app in the registry.
Now install it as a native Docker App by referencing the app in the registry, with a different port. Now install it as a native Docker App by referencing the app in the registry, with a different port.

2
desktop/enterprise/user/mac-user.md
View File

@ -212,7 +212,7 @@ true
##### Insecure registries ##### Insecure registries
You can set up a custom and insecure [registry](https://docs.docker.com/registry/introduction) to store your public or private images (instead of You can set up a custom and insecure [registry](https://docs.docker.com/registry/introduction) to store your public or private images (instead of
using [Docker Hub](https://hub.docker.com/) or [Docker Trusted Registry](https://docs.docker.com/ee/dtr/). Add URLs for using [Docker Hub](https://hub.docker.com/). Add URLs for
your insecure registries and registry mirrors on which to host your images. your insecure registries and registry mirrors on which to host your images.
For more information, see: For more information, see:

3
desktop/enterprise/user/windows-user.md
View File

@ -352,8 +352,7 @@ Server:
You can set up your own [registries](https://docs.docker.com/registry/introduction) on the **Basic** Daemon settings. You can set up your own [registries](https://docs.docker.com/registry/introduction) on the **Basic** Daemon settings.
Normally, you store public or private images in [Docker Hub](https://hub.docker.com/) Normally, you store public or private images in [Docker Hub](https://hub.docker.com/). Here, you
and [Docker Trusted Registry](https://docs.docker.com/ee/dtr/). Here, you
can use Docker to set up your own [insecure registry](https://docs.docker.com/registry/insecure/). can use Docker to set up your own [insecure registry](https://docs.docker.com/registry/insecure/).
Simply add URLs for insecure registries and registry mirrors on which to host your images. Simply add URLs for insecure registries and registry mirrors on which to host your images.

2
docker-for-mac/docker-toolbox.md
View File

@ -159,8 +159,6 @@ is running a different version of server.
default * virtualbox Running tcp://192.168.99.100:2376 v19.03.2 default * virtualbox Running tcp://192.168.99.100:2376 v19.03.2
docker-sandbox - digitalocean Running tcp://104.131.43.236:2376 v19.03.1 docker-sandbox - digitalocean Running tcp://104.131.43.236:2376 v19.03.1
You might also run into a similar situation with Docker Universal Control Plane (UCP).
There are a few ways to address this problem and keep using your older There are a few ways to address this problem and keep using your older
machines. One solution is to use a version manager like machines. One solution is to use a version manager like
[DVM](https://github.com/getcarina/dvm). [DVM](https://github.com/getcarina/dvm).

4
docker-for-windows/index.md
View File

@ -17,7 +17,7 @@ toc_max: 2
Welcome to Docker Desktop! Welcome to Docker Desktop!
The _Docker Desktop for Windows_ section contains information about the Docker Desktop Community Stable release. For information about features available in Edge releases, see the [Edge release notes](edge-release-notes/). For information about Docker Desktop Enterprise (DDE) releases, see [Docker Desktop Enterprise](/desktop/enterprise/). The _Docker Desktop for Windows_ section contains information about the Docker Desktop Community Stable release. For information about features available in Edge releases, see the [Edge release notes](edge-release-notes.md). For information about Docker Desktop Enterprise (DDE) releases, see [Docker Desktop Enterprise](/desktop/enterprise/).
Docker is a full development platform to build, run, and share containerized applications. Docker Desktop is the best way to get started with Docker _on Windows_. Docker is a full development platform to build, run, and share containerized applications. Docker Desktop is the best way to get started with Docker _on Windows_.
@ -547,7 +547,7 @@ Docker Desktop creates a certificate bundle of all user-trusted CAs based on
the Windows certificate store, and appends it to Moby trusted certificates. Therefore, if an enterprise SSL certificate is trusted by the user on the host, it is trusted by Docker Desktop. the Windows certificate store, and appends it to Moby trusted certificates. Therefore, if an enterprise SSL certificate is trusted by the user on the host, it is trusted by Docker Desktop.
To learn more about how to install a CA root certificate for the registry, see To learn more about how to install a CA root certificate for the registry, see
[Verify repository client with certificates](/engine/security/certificates) [Verify repository client with certificates](../engine/security/certificates.md)
in the Docker Engine topics. in the Docker Engine topics.
### How do I add client certificates? ### How do I add client certificates?

2
docker-hub/publish/certify-plugins-logging.md
View File

@ -213,7 +213,7 @@ There are two steps: (1) configure credentials, and (2) configure endpoints.
-get-logs-script string -get-logs-script string
An optional custom script used to retrieve the logs. An optional custom script used to retrieve the logs.
-insecure-skip-verify -insecure-skip-verify
Optional. Specifies to disable SSL verification for an insecure private Docker Trusted Registry. Optional. Specifies to disable SSL verification for an insecure private Docker Registry.
-help -help
Help on the command. Help on the command.
-html -html

2
engine/context/working-with-contexts.md
View File

@ -210,8 +210,6 @@ You can verify that the context was imported with `docker context ls`.
The format of the import command is `docker context import <context-name> <context-file>`. The format of the import command is `docker context import <context-name> <context-file>`.
> **Note**: You can import the client bundle `.zip` file generated from UCP and run a command to set your context to UCP. For example, `docker context import ctx-name ucp-bundle.zip`.
Now, let's look at exporting just the Kubernetes parts of a context. Now, let's look at exporting just the Kubernetes parts of a context.
### Exporting a Kubernetes context ### Exporting a Kubernetes context

7
engine/install/linux-postinstall.md
View File

@ -142,13 +142,6 @@ Docker provides the [capability](../../config/containers/logging/index.md) to co
By default, the Docker daemon listens for connections on a UNIX socket to accept requests from local clients. It is possible to allow Docker to accept requests from remote hosts by configuring it to listen on an IP address and port as well as the UNIX socket. For more detailed information on this configuration option take a look at "Bind Docker to another host/port or a unix socket" section of the [Docker CLI Reference](https://docs.docker.com/engine/reference/commandline/dockerd/) article. By default, the Docker daemon listens for connections on a UNIX socket to accept requests from local clients. It is possible to allow Docker to accept requests from remote hosts by configuring it to listen on an IP address and port as well as the UNIX socket. For more detailed information on this configuration option take a look at "Bind Docker to another host/port or a unix socket" section of the [Docker CLI Reference](https://docs.docker.com/engine/reference/commandline/dockerd/) article.
> Docker EE customers
>
> Docker EE customers can get remote CLI access to UCP with the UCP client bundle.
> A UCP Client Bundle is generated by UCP and secured by mutual TLS. See the document on
> [CLI access for UCP](https://docs.docker.com/ee/ucp/user-access/cli/) for more
> information.
> Secure your connection > Secure your connection
> >
> Before configuring Docker to accept connections from remote hosts it is critically important that you > Before configuring Docker to accept connections from remote hosts it is critically important that you

49
engine/security/trust/content_trust.md
View File

@ -108,21 +108,18 @@ Within the Docker CLI we can sign and push a container image with the
set, more information on Notary can be found [here](/notary/getting_started/). set, more information on Notary can be found [here](/notary/getting_started/).
A prerequisite for signing an image is a Docker Registry with a Notary server A prerequisite for signing an image is a Docker Registry with a Notary server
attached (Such as the Docker Hub or Docker Trusted Registry). Instructions for attached (Such as the Docker Hub ). Instructions for
standing up a self-hosted environment can be found [here](/engine/security/trust/deploying_notary/). standing up a self-hosted environment can be found [here](/engine/security/trust/deploying_notary/).
To sign a Docker Image you will need a delegation key pair. These keys To sign a Docker Image you will need a delegation key pair. These keys
can be generated locally using `$ docker trust key generate`, generated can be generated locally using `$ docker trust key generate` or generated
by a certificate authority, or if you are using Docker Enterprise's by a certificate authority.
Universal Control Plane (UCP), a user's Client Bundle provides adequate keys for a
delegation. Find more information on Delegation Keys
[here](trust_delegation/#creating-delegation-keys).
First we will add the delegation private key to the local Docker trust First we will add the delegation private key to the local Docker trust
repository. (By default this is stored in `~/.docker/trust/`). If you are repository. (By default this is stored in `~/.docker/trust/`). If you are
generating delegation keys with `$ docker trust key generate`, the private key generating delegation keys with `$ docker trust key generate`, the private key
is automatically added to the local trust store. If you are importing a separate is automatically added to the local trust store. If you are importing a separate
key, such as one from a UCP Client Bundle you will need to use the key, you will need to use the
`$ docker trust key load` command. `$ docker trust key load` command.
``` ```
@ -152,8 +149,8 @@ role of delegations, head to
[delegations for content trust](trust_delegation/#managing-delegations-in-a-notary-server). [delegations for content trust](trust_delegation/#managing-delegations-in-a-notary-server).
``` ```
$ docker trust signer add --key cert.pem jeff dtr.example.com/admin/demo $ docker trust signer add --key cert.pem jeff registry.example.com/admin/demo
Adding signer "jeff" to dtr.example.com/admin/demo... Adding signer "jeff" to registry.example.com/admin/demo...
Enter passphrase for new repository key with ID 10b5e94: Enter passphrase for new repository key with ID 10b5e94:
``` ```
@ -161,14 +158,14 @@ Finally, we will use the delegation private key to sign a particular tag and
push it up to the registry. push it up to the registry.
``` ```
$ docker trust sign dtr.example.com/admin/demo:1 $ docker trust sign registry.example.com/admin/demo:1
Signing and pushing trust data for local image dtr.example.com/admin/demo:1, may overwrite remote trust data Signing and pushing trust data for local image registry.example.com/admin/demo:1, may overwrite remote trust data
The push refers to repository [dtr.example.com/admin/demo] The push refers to repository [registry.example.com/admin/demo]
7bff100f35cb: Pushed 7bff100f35cb: Pushed
1: digest: sha256:3d2e482b82608d153a374df3357c0291589a61cc194ec4a9ca2381073a17f58e size: 528 1: digest: sha256:3d2e482b82608d153a374df3357c0291589a61cc194ec4a9ca2381073a17f58e size: 528
Signing and pushing trust metadata Signing and pushing trust metadata
Enter passphrase for signer key with ID 8ae710e: Enter passphrase for signer key with ID 8ae710e:
Successfully signed dtr.example.com/admin/demo:1 Successfully signed registry.example.com/admin/demo:1
``` ```
Alternatively, once the keys have been imported an image can be pushed with the Alternatively, once the keys have been imported an image can be pushed with the
@ -177,32 +174,32 @@ Alternatively, once the keys have been imported an image can be pushed with the
``` ```
$ export DOCKER_CONTENT_TRUST=1 $ export DOCKER_CONTENT_TRUST=1
$ docker push dtr.example.com/admin/demo:1 $ docker push registry.example.com/admin/demo:1
The push refers to repository [dtr.example.com/admin/demo:1] The push refers to repository [registry.example.com/admin/demo:1]
7bff100f35cb: Pushed 7bff100f35cb: Pushed
1: digest: sha256:3d2e482b82608d153a374df3357c0291589a61cc194ec4a9ca2381073a17f58e size: 528 1: digest: sha256:3d2e482b82608d153a374df3357c0291589a61cc194ec4a9ca2381073a17f58e size: 528
Signing and pushing trust metadata Signing and pushing trust metadata
Enter passphrase for signer key with ID 8ae710e: Enter passphrase for signer key with ID 8ae710e:
Successfully signed dtr.example.com/admin/demo:1 Successfully signed registry.example.com/admin/demo:1
``` ```
Remote trust data for a tag or a repository can be viewed by the Remote trust data for a tag or a repository can be viewed by the
`$ docker trust inspect` command: `$ docker trust inspect` command:
``` ```
$ docker trust inspect --pretty dtr.example.com/admin/demo:1 $ docker trust inspect --pretty registry.example.com/admin/demo:1
Signatures for dtr.example.com/admin/demo:1 Signatures for registry.example.com/admin/demo:1
SIGNED TAG DIGEST SIGNERS SIGNED TAG DIGEST SIGNERS
1 3d2e482b82608d153a374df3357c0291589a61cc194ec4a9ca2381073a17f58e jeff 1 3d2e482b82608d153a374df3357c0291589a61cc194ec4a9ca2381073a17f58e jeff
List of signers and their keys for dtr.example.com/admin/demo:1 List of signers and their keys for registry.example.com/admin/demo:1
SIGNER KEYS SIGNER KEYS
jeff 8ae710e3ba82 jeff 8ae710e3ba82
Administrative keys for dtr.example.com/admin/demo:1 Administrative keys for registry.example.com/admin/demo:1
Repository Key: 10b5e94c916a0977471cc08fa56c1a5679819b2005ba6a257aa78ce76d3a1e27 Repository Key: 10b5e94c916a0977471cc08fa56c1a5679819b2005ba6a257aa78ce76d3a1e27
Root Key: 84ca6e4416416d78c4597e754f38517bea95ab427e5f95871f90d460573071fc Root Key: 84ca6e4416416d78c4597e754f38517bea95ab427e5f95871f90d460573071fc
@ -211,9 +208,9 @@ Administrative keys for dtr.example.com/admin/demo:1
Remote Trust data for a tag can be removed by the `$ docker trust revoke` command: Remote Trust data for a tag can be removed by the `$ docker trust revoke` command:
``` ```
$ docker trust revoke dtr.example.com/admin/demo:1 $ docker trust revoke registry.example.com/admin/demo:1
Enter passphrase for signer key with ID 8ae710e: Enter passphrase for signer key with ID 8ae710e:
Successfully deleted signature for dtr.example.com/admin/demo:1 Successfully deleted signature for registry.example.com/admin/demo:1
``` ```
## Runtime Enforcement with Docker Content Trust ## Runtime Enforcement with Docker Content Trust
@ -416,15 +413,15 @@ succeeds if `someimage:latest` is signed. However, an operation with an explicit
content hash always succeeds as long as the hash exists: content hash always succeeds as long as the hash exists:
``` ```
$ docker pull dtr.example.com/user/image:1 $ docker pull registry.example.com/user/image:1
Error: remote trust data does not exist for dtr.example.com/user/image: dtr.example.com does not have trust data for dtr.example.com/user/image Error: remote trust data does not exist for registry.example.com/user/image: registry.example.com does not have trust data for registry.example.com/user/image
$ docker pull dtr.example.com/user/image@sha256:d149ab53f8718e987c3a3024bb8aa0e2caadf6c0328f1d9d850b2a2a67f2819a $ docker pull registry.example.com/user/image@sha256:d149ab53f8718e987c3a3024bb8aa0e2caadf6c0328f1d9d850b2a2a67f2819a
sha256:ee7491c9c31db1ffb7673d91e9fac5d6354a89d0e97408567e09df069a1687c1: Pulling from user/image sha256:ee7491c9c31db1ffb7673d91e9fac5d6354a89d0e97408567e09df069a1687c1: Pulling from user/image
ff3a5c916c92: Pull complete ff3a5c916c92: Pull complete
a59a168caba3: Pull complete a59a168caba3: Pull complete
Digest: sha256:ee7491c9c31db1ffb7673d91e9fac5d6354a89d0e97408567e09df069a1687c1 Digest: sha256:ee7491c9c31db1ffb7673d91e9fac5d6354a89d0e97408567e09df069a1687c1
Status: Downloaded newer image for dtr.example.com/user/image@sha256:ee7491c9c31db1ffb7673d91e9fac5d6354a89d0e97408567e09df069a1687c1 Status: Downloaded newer image for registry.example.com/user/image@sha256:ee7491c9c31db1ffb7673d91e9fac5d6354a89d0e97408567e09df069a1687c1
``` ```
## Related information ## Related information

18
engine/security/trust/trust_automation.md
View File

@ -43,11 +43,11 @@ $ export DOCKER_CONTENT_TRUST_ROOT_PASSPHRASE="rootpassphrase123"
$ export DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE="repopassphrase123" $ export DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE="repopassphrase123"
# Initialise Repo and Push Delegation # Initialise Repo and Push Delegation
$ docker trust signer add --key delegation.crt jeff dtr.example.com/admin/demo $ docker trust signer add --key delegation.crt jeff registry.example.com/admin/demo
Adding signer "jeff" to dtr.example.com/admin/demo... Adding signer "jeff" to registry.example.com/admin/demo...
Initializing signed repository for dtr.example.com/admin/demo... Initializing signed repository for registry.example.com/admin/demo...
Successfully initialized "dtr.example.com/admin/demo" Successfully initialized "registry.example.com/admin/demo"
Successfully added signer: dtr.example.com/admin/demo Successfully added signer: registry.example.com/admin/demo
``` ```
## Sign an image ## Sign an image
@ -59,13 +59,13 @@ trust store with `$ docker trust key load`.
``` ```
$ export DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE="mypassphrase123" $ export DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE="mypassphrase123"
$ docker trust sign dtr.example.com/admin/demo:1 $ docker trust sign registry.example.com/admin/demo:1
Signing and pushing trust data for local image dtr.example.com/admin/demo:1, may overwrite remote trust data Signing and pushing trust data for local image registry.example.com/admin/demo:1, may overwrite remote trust data
The push refers to repository [dtr.example.com/admin/demo] The push refers to repository [registry.example.com/admin/demo]
428c97da766c: Layer already exists 428c97da766c: Layer already exists
2: digest: sha256:1a6fd470b9ce10849be79e99529a88371dff60c60aab424c077007f6979b4812 size: 524 2: digest: sha256:1a6fd470b9ce10849be79e99529a88371dff60c60aab424c077007f6979b4812 size: 524
Signing and pushing trust metadata Signing and pushing trust metadata
Successfully signed dtr.example.com/admin/demo:1 Successfully signed registry.example.com/admin/demo:1
``` ```
## Build with content trust ## Build with content trust

114
engine/security/trust/trust_delegation.md
View File

@ -36,12 +36,12 @@ If you do not export this variable in self-hosted environments, you may see
errors such as: errors such as:
``` ```
$ docker trust signer add --key cert.pem jeff dtr.example.com/admin/demo $ docker trust signer add --key cert.pem jeff registry.example.com/admin/demo
Adding signer "jeff" to dtr.example.com/admin/demo... Adding signer "jeff" to registry.example.com/admin/demo...
[...] [...]
Error: trust data missing for remote repository dtr.example.com/admin/demo or remote repository not found: timestamp key trust data unavailable. Has a notary repository been initialized? Error: trust data missing for remote repository registry.example.com/admin/demo or remote repository not found: timestamp key trust data unavailable. Has a notary repository been initialized?
$ docker trust inspect dtr.example.com/admin/demo --pretty $ docker trust inspect registry.example.com/admin/demo --pretty
WARN[0000] Error while downloading remote metadata, using cached timestamp - this might not be the latest version available remotely WARN[0000] Error while downloading remote metadata, using cached timestamp - this might not be the latest version available remotely
[...] [...]
``` ```
@ -50,28 +50,28 @@ If you have enabled authentication for your notary server, or are using DTR, you
before you can push data to the notary server. before you can push data to the notary server.
``` ```
$ docker login dtr.example.com/user/repo $ docker login registry.example.com/user/repo
Username: admin Username: admin
Password: Password:
Login Succeeded Login Succeeded
$ docker trust signer add --key cert.pem jeff dtr.example.com/user/repo $ docker trust signer add --key cert.pem jeff registry.example.com/user/repo
Adding signer "jeff" to dtr.example.com/user/repo... Adding signer "jeff" to registry.example.com/user/repo...
Initializing signed repository for dtr.example.com/user/repo... Initializing signed repository for registry.example.com/user/repo...
Successfully initialized "dtr.example.com/user/repo" Successfully initialized "registry.example.com/user/repo"
Successfully added signer: jeff to dtr.example.com/user/repo Successfully added signer: jeff to registry.example.com/user/repo
``` ```
If you do not log in, you will see: If you do not log in, you will see:
```bash ```bash
$ docker trust signer add --key cert.pem jeff dtr.example.com/user/repo $ docker trust signer add --key cert.pem jeff registry.example.com/user/repo
Adding signer "jeff" to dtr.example.com/user/repo... Adding signer "jeff" to registry.example.com/user/repo...
Initializing signed repository for dtr.example.com/user/repo... Initializing signed repository for registry.example.com/user/repo...
you are not authorized to perform this operation: server returned 401. you are not authorized to perform this operation: server returned 401.
Failed to add signer to: dtr.example.com/user/repo Failed to add signer to: registry.example.com/user/repo
``` ```
## Configuring the Notary Client ## Configuring the Notary Client
@ -88,7 +88,7 @@ and ensure that it is available on your path.
{ {
"trust_dir" : "~/.docker/trust", "trust_dir" : "~/.docker/trust",
"remote_server": { "remote_server": {
"url": "https://dtr.example.com", "url": "https://registry.example.com",
"root_ca": "../.docker/ca.pem" "root_ca": "../.docker/ca.pem"
} }
} }
@ -211,32 +211,32 @@ For DCT the name of the second delegation, in the below example
advanced use cases of Notary additional delegations are used for hierarchy. advanced use cases of Notary additional delegations are used for hierarchy.
```bash ```bash
$ docker trust signer add --key cert.pem jeff dtr.example.com/admin/demo $ docker trust signer add --key cert.pem jeff registry.example.com/admin/demo
Adding signer "jeff" to dtr.example.com/admin/demo... Adding signer "jeff" to registry.example.com/admin/demo...
Initializing signed repository for dtr.example.com/admin/demo... Initializing signed repository for registry.example.com/admin/demo...
Enter passphrase for root key with ID f6c6a4b: Enter passphrase for root key with ID f6c6a4b:
Enter passphrase for new repository key with ID b0014f8: Enter passphrase for new repository key with ID b0014f8:
Repeat passphrase for new repository key with ID b0014f8: Repeat passphrase for new repository key with ID b0014f8:
Successfully initialized "dtr.example.com/admin/demo" Successfully initialized "registry.example.com/admin/demo"
Successfully added signer: jeff to dtr.example.com/admin/demo Successfully added signer: jeff to registry.example.com/admin/demo
``` ```
You can see which keys have been pushed to the Notary server for each repository You can see which keys have been pushed to the Notary server for each repository
with the `$ docker trust inspect` command. with the `$ docker trust inspect` command.
```bash ```bash
$ docker trust inspect --pretty dtr.example.com/admin/demo $ docker trust inspect --pretty registry.example.com/admin/demo
No signatures for dtr.example.com/admin/demo No signatures for registry.example.com/admin/demo
List of signers and their keys for dtr.example.com/admin/demo List of signers and their keys for registry.example.com/admin/demo
SIGNER KEYS SIGNER KEYS
jeff 1091060d7bfd jeff 1091060d7bfd
Administrative keys for dtr.example.com/admin/demo Administrative keys for registry.example.com/admin/demo
Repository Key: b0014f8e4863df2d028095b74efcb05d872c3591de0af06652944e310d96598d Repository Key: b0014f8e4863df2d028095b74efcb05d872c3591de0af06652944e310d96598d
Root Key: 64d147e59e44870311dd2d80b9f7840039115ef3dfa5008127d769a5f657a5d7 Root Key: 64d147e59e44870311dd2d80b9f7840039115ef3dfa5008127d769a5f657a5d7
@ -246,7 +246,7 @@ You could also use the Notary CLI to list delegations and keys. Here you can
clearly see the keys were attached to `targets/releases` and `targets/jeff`. clearly see the keys were attached to `targets/releases` and `targets/jeff`.
```bash ```bash
$ notary delegation list dtr.example.com/admin/demo $ notary delegation list registry.example.com/admin/demo
ROLE PATHS KEY IDS THRESHOLD ROLE PATHS KEY IDS THRESHOLD
---- ----- ------- --------- ---- ----- ------- ---------
@ -266,27 +266,27 @@ the `targets/release` role.
> configured when you first initiated the repository. > configured when you first initiated the repository.
```bash ```bash
$ docker trust signer add --key ben.pub ben dtr.example.com/admin/demo $ docker trust signer add --key ben.pub ben registry.example.com/admin/demo
Adding signer "ben" to dtr.example.com/admin/demo... Adding signer "ben" to registry.example.com/admin/demo...
Enter passphrase for repository key with ID b0014f8: Enter passphrase for repository key with ID b0014f8:
Successfully added signer: ben to dtr.example.com/admin/demo Successfully added signer: ben to registry.example.com/admin/demo
``` ```
Check to prove that there are now 2 delegations (Signer). Check to prove that there are now 2 delegations (Signer).
```bash ```bash
$ docker trust inspect --pretty dtr.example.com/admin/demo $ docker trust inspect --pretty registry.example.com/admin/demo
No signatures for dtr.example.com/admin/demo No signatures for registry.example.com/admin/demo
List of signers and their keys for dtr.example.com/admin/demo List of signers and their keys for registry.example.com/admin/demo
SIGNER KEYS SIGNER KEYS
ben afa404703b25 ben afa404703b25
jeff 1091060d7bfd jeff 1091060d7bfd
Administrative keys for dtr.example.com/admin/demo Administrative keys for registry.example.com/admin/demo
Repository Key: b0014f8e4863df2d028095b74efcb05d872c3591de0af06652944e310d96598d Repository Key: b0014f8e4863df2d028095b74efcb05d872c3591de0af06652944e310d96598d
Root Key: 64d147e59e44870311dd2d80b9f7840039115ef3dfa5008127d769a5f657a5d7 Root Key: 64d147e59e44870311dd2d80b9f7840039115ef3dfa5008127d769a5f657a5d7
@ -303,27 +303,27 @@ will automatically handle adding this new key to `targets/releases`.
> configured when you first initiated the repository. > configured when you first initiated the repository.
```bash ```bash
$ docker trust signer add --key cert2.pem jeff dtr.example.com/admin/demo $ docker trust signer add --key cert2.pem jeff registry.example.com/admin/demo
Adding signer "jeff" to dtr.example.com/admin/demo... Adding signer "jeff" to registry.example.com/admin/demo...
Enter passphrase for repository key with ID b0014f8: Enter passphrase for repository key with ID b0014f8:
Successfully added signer: jeff to dtr.example.com/admin/demo Successfully added signer: jeff to registry.example.com/admin/demo
``` ```
Check to prove that the delegation (Signer) now contains multiple Key IDs. Check to prove that the delegation (Signer) now contains multiple Key IDs.
```bash ```bash
$ docker trust inspect --pretty dtr.example.com/admin/demo $ docker trust inspect --pretty registry.example.com/admin/demo
No signatures for dtr.example.com/admin/demo No signatures for registry.example.com/admin/demo
List of signers and their keys for dtr.example.com/admin/demo List of signers and their keys for registry.example.com/admin/demo
SIGNER KEYS SIGNER KEYS
jeff 1091060d7bfd, 5570b88df073 jeff 1091060d7bfd, 5570b88df073
Administrative keys for dtr.example.com/admin/demo Administrative keys for registry.example.com/admin/demo
Repository Key: b0014f8e4863df2d028095b74efcb05d872c3591de0af06652944e310d96598d Repository Key: b0014f8e4863df2d028095b74efcb05d872c3591de0af06652944e310d96598d
Root Key: 64d147e59e44870311dd2d80b9f7840039115ef3dfa5008127d769a5f657a5d7 Root Key: 64d147e59e44870311dd2d80b9f7840039115ef3dfa5008127d769a5f657a5d7
@ -339,10 +339,10 @@ attached to the `targets/releases` role, you can use the
> by an active delegation > by an active delegation
```bash ```bash
$ docker trust signer remove dtr.example.com/admin/demo $ docker trust signer remove registry.example.com/admin/demo
Removing signer "ben" from dtr.example.com/admin/demo... Removing signer "ben" from registry.example.com/admin/demo...
Enter passphrase for repository key with ID b0014f8: Enter passphrase for repository key with ID b0014f8:
Successfully removed ben from dtr.example.com/admin/demo Successfully removed ben from registry.example.com/admin/demo
``` ```
#### Troubleshooting #### Troubleshooting
@ -366,7 +366,7 @@ WARN[0000] Error getting targets/releases: valid signatures did not meet thresho
Resigning the delegation file is done with the `$ notary witness` command Resigning the delegation file is done with the `$ notary witness` command
```bash ```bash
$ notary witness dtr.example.com/admin/demo targets/releases --publish $ notary witness registry.example.com/admin/demo targets/releases --publish
``` ```
More information on the `$ notary witness` command can be found More information on the `$ notary witness` command can be found
@ -383,7 +383,7 @@ and the role specific to that signer `targets/<name>`.
1) We will need to grab the Key ID from the Notary Server 1) We will need to grab the Key ID from the Notary Server
```bash ```bash
$ notary delegation list dtr.example.com/admin/demo $ notary delegation list registry.example.com/admin/demo
ROLE PATHS KEY IDS THRESHOLD ROLE PATHS KEY IDS THRESHOLD
---- ----- ------- --------- ---- ----- ------- ---------
@ -396,33 +396,33 @@ targets/releases "" <all paths> 8fb597cbaf196f0781628b2f52bff6b3912e4e8075
2) Remove from the `targets/releases` delegation 2) Remove from the `targets/releases` delegation
```bash ```bash
$ notary delegation remove dtr.example.com/admin/demo targets/targets 1091060d7bfd938dfa5be703fa057974f9322a4faef6f580334f3d6df44c02d1 --publish $ notary delegation remove registry.example.com/admin/demo targets/targets 1091060d7bfd938dfa5be703fa057974f9322a4faef6f580334f3d6df44c02d1 --publish
Auto-publishing changes to dtr.example.com/admin/demo Auto-publishing changes to registry.example.com/admin/demo
Enter username: admin Enter username: admin
Enter password: Enter password:
Enter passphrase for targets key with ID b0014f8: Enter passphrase for targets key with ID b0014f8:
Successfully published changes for repository dtr.example.com/admin/demo Successfully published changes for repository registry.example.com/admin/demo
``` ```
3) Remove from the `targets/<name>` delegation 3) Remove from the `targets/<name>` delegation
```bash ```bash
$ notary delegation remove dtr.example.com/admin/demo targets/jeff 1091060d7bfd938dfa5be703fa057974f9322a4faef6f580334f3d6df44c02d1 --publish $ notary delegation remove registry.example.com/admin/demo targets/jeff 1091060d7bfd938dfa5be703fa057974f9322a4faef6f580334f3d6df44c02d1 --publish
Removal of delegation role targets/jeff with keys [5570b88df0736c468493247a07e235e35cf3641270c944d0e9e8899922fc6f99], to repository "dtr.example.com/admin/demo" staged for next publish. Removal of delegation role targets/jeff with keys [5570b88df0736c468493247a07e235e35cf3641270c944d0e9e8899922fc6f99], to repository "registry.example.com/admin/demo" staged for next publish.
Auto-publishing changes to dtr.example.com/admin/demo Auto-publishing changes to registry.example.com/admin/demo
Enter username: admin Enter username: admin
Enter password: Enter password:
Enter passphrase for targets key with ID b0014f8: Enter passphrase for targets key with ID b0014f8:
Successfully published changes for repository dtr.example.com/admin/demo Successfully published changes for repository registry.example.com/admin/demo
``` ```
4) Check the remaining delegation list 4) Check the remaining delegation list
```bash ```bash
$ notary delegation list dtr.example.com/admin/demo $ notary delegation list registry.example.com/admin/demo
ROLE PATHS KEY IDS THRESHOLD ROLE PATHS KEY IDS THRESHOLD
---- ----- ------- --------- ---- ----- ------- ---------
@ -468,16 +468,16 @@ This is often required by a container registry before a particular repository
can be deleted. can be deleted.
```bash ```bash
$ notary delete dtr.example.com/admin/demo --remote $ notary delete registry.example.com/admin/demo --remote
Deleting trust data for repository dtr.example.com/admin/demo Deleting trust data for repository registry.example.com/admin/demo
Enter username: admin Enter username: admin
Enter password: Enter password:
Successfully deleted local and remote trust data for repository dtr.example.com/admin/demo Successfully deleted local and remote trust data for repository registry.example.com/admin/demo
$ docker trust inspect --pretty dtr.example.com/admin/demo $ docker trust inspect --pretty registry.example.com/admin/demo
No signatures or cannot access dtr.example.com/admin/demo No signatures or cannot access registry.example.com/admin/demo
``` ```
## Related information ## Related information

4
engine/swarm/admin_guide.md
View File

@ -271,10 +271,6 @@ You can back up the swarm using any manager. Use the following procedure.
To restore, see [Restore from a backup](#restore-from-a-backup). To restore, see [Restore from a backup](#restore-from-a-backup).
> Note
>
> When trying to restore swarm with UCP installed, swarm mode relies on UCP to provide the CA certificates that allow nodes in the cluster to identify one another.
## Recover from disaster ## Recover from disaster
### Restore from a backup ### Restore from a backup

2
engine/swarm/how-swarm-mode-works/swarm-task-states.md
View File

@ -10,7 +10,7 @@ Docker lets you create services, which can start tasks. A service is a
description of a desired state, and a task does the work. Work is scheduled on description of a desired state, and a task does the work. Work is scheduled on
swarm nodes in this sequence: swarm nodes in this sequence:
1. Create a service by using `docker service create` or the UCP web UI or CLI. 1. Create a service by using `docker service create`.
2. The request goes to a Docker manager node. 2. The request goes to a Docker manager node.
3. The Docker manager node schedules the service to run on particular nodes. 3. The Docker manager node schedules the service to run on particular nodes.
4. Each service can start multiple tasks. 4. Each service can start multiple tasks.

3
get-started/overview.md
View File

@ -127,8 +127,7 @@ Docker API. The Docker client can communicate with more than one daemon.
A Docker _registry_ stores Docker images. Docker Hub is a public A Docker _registry_ stores Docker images. Docker Hub is a public
registry that anyone can use, and Docker is configured to look for images on registry that anyone can use, and Docker is configured to look for images on
Docker Hub by default. You can even run your own private registry. If you use Docker Hub by default. You can even run your own private registry.
Docker Datacenter (DDC), it includes Docker Trusted Registry (DTR).
When you use the `docker pull` or `docker run` commands, the required images are When you use the `docker pull` or `docker run` commands, the required images are
pulled from your configured registry. When you use the `docker push` command, pulled from your configured registry. When you use the `docker push` command,

13
registry/index.md
View File

@ -6,16 +6,6 @@ redirect_from:
title: Docker Registry title: Docker Registry
--- ---
> Looking for Docker Trusted Registry?
>
> Docker Trusted Registry (DTR) is a commercial product that enables complete
> image management workflow, featuring LDAP integration, image signing,
> security scanning, and integration with Universal Control Plane. DTR is
> offered as an add-on to Docker Enterprise subscriptions of Standard or
> higher.
>
> [Go to Docker Trusted Registry](/ee/dtr/){: class="button outline-btn" }
## What it is ## What it is
The Registry is a stateless, highly scalable server side application that stores The Registry is a stateless, highly scalable server side application that stores
@ -37,9 +27,6 @@ head-over to the [Docker Hub](https://hub.docker.com), which provides a
free-to-use, hosted Registry, plus additional features (organization accounts, free-to-use, hosted Registry, plus additional features (organization accounts,
automated builds, and more). automated builds, and more).
Users looking for a commercially supported version of the Registry should look
into [Docker Trusted Registry](/ee/dtr/).
## Requirements ## Requirements
The Registry is compatible with Docker engine **version 1.6.0 or higher**. The Registry is compatible with Docker engine **version 1.6.0 or higher**.