docker
/
docs
mirror of https://github.com/docker/docs.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Created instructions for adding or removing FIPS support in RHEL.

This commit is contained in:
Anne Henmi 2018-09-24 08:01:59 -06:00
parent a83dc18d93
commit b61e11f41d
1 changed files with 16 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
install/linux/docker-ee/rhel.md
View File

@ -44,12 +44,27 @@ On {{ linux-dist-long }}, Docker EE supports storage drivers, `overlay2` and `de
- [Device Mapper](/storage/storagedriver/device-mapper-driver/){: target="_blank" class="_" }: On production systems using `devicemapper`, you must use `direct-lvm` mode, which requires one or more dedicated block devices. Fast storage such as solid-state media (SSD) is recommended. Do not start Docker until properly configured per the [storage guide](/storage/storagedriver/device-mapper-driver/){: target="_blank" class="_" }. - [Device Mapper](/storage/storagedriver/device-mapper-driver/){: target="_blank" class="_" }: On production systems using `devicemapper`, you must use `direct-lvm` mode, which requires one or more dedicated block devices. Fast storage such as solid-state media (SSD) is recommended. Do not start Docker until properly configured per the [storage guide](/storage/storagedriver/device-mapper-driver/){: target="_blank" class="_" }.
### FIPS 140-2 support ### FIPS 140-2 cryptographic module support
With Docker EE Basic license for versions 18.03 and later, Docker provides FIPS support in RHEL 7.3, 7.4 and 7.5. This includes a FIPS support cryptographic module. If the RHEL implementation already has FIPS support enabled, FIPS will be automatically enabled in the Docker engine. With Docker EE Basic license for versions 18.03 and later, Docker provides FIPS support in RHEL 7.3, 7.4 and 7.5. This includes a FIPS support cryptographic module. If the RHEL implementation already has FIPS support enabled, FIPS will be automatically enabled in the Docker engine.
**NOTE:** FIPS is only supported in the Docker EE engine. UCP and DTR currently do not have support for FISP-140-2. **NOTE:** FIPS is only supported in the Docker EE engine. UCP and DTR currently do not have support for FISP-140-2.
To force FIPS-140-2 compliance with the Docker EE engine, do the following:
Create a file called `/etc/systemd/system/docker.service.d/fips-module`. It needs to contain the following:
```
[Service]
Environment="DOCKER_FIPS=1"
```
Restart the Docker service as root.
`$ sudo service dockerd restart`
**NOTE:** If the system has the FIPS-140-2 cryptographic module installed on the operating system, it is possible to disable FIPS-140-2 compliance. To disable FIPS-140-2 in Docker but not the operating system, set the value `DOCKER_FIPS=0" in the `/etc/systemd/system/docker.service.d/fips-module`.
### Find your Docker EE repo URL ### Find your Docker EE repo URL
{% include ee-linux-install-reuse.md section="find-ee-repo-url" %} {% include ee-linux-install-reuse.md section="find-ee-repo-url" %}