Skip to content

docs: say --tls still loads ~/.docker/ca.pem #7201

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
locker95 wants to merge 1 commit into
base: master
Choose a base branch
from
+10 −1
Open

docs: say --tls still loads ~/.docker/ca.pem #7201

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions docs/reference/commandline/docker.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,6 +86,11 @@ The base command for the Docker CLI.

## Description

`--tls` turns on TLS for the client. The CLI still loads `--tlscacert`
(default `~/.docker/ca.pem`) and errors if that file is missing. It does
not use the system CA pool. Without `--tlsverify`, the daemon certificate
is not verified.

Depending on your Docker system configuration, you may be required to preface
each `docker` command with `sudo`. To avoid having to use `sudo` with the
`docker` command, your system administrator can create a Unix group called
Expand Down
6 changes: 5 additions & 1 deletion man/docker.1.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,9 +38,13 @@ unix://[/path/to/socket] to use.

**--tls**=*true*|*false*
Use TLS; implied by --tlsverify. Default is false.
The client still loads --tlscacert (default ~/.docker/ca.pem) and
errors if that file is missing. It does not fall back to the system
CA pool. Without --tlsverify the daemon certificate is not verified.

**--tlscacert**=*~/.docker/ca.pem*
Trust certs signed only by this CA.
Trust certs signed only by this CA. Always used when TLS is on,
including --tls without --tlsverify.

**--tlscert**=*~/.docker/cert.pem*
Path to TLS certificate file.
Expand Down