archive
/
watchtower
mirror of https://github.com/containrrr/watchtower
1
0
Fork 0
Code Releases Activity

Rework TLS support, remove unsupported options

Browse Source
pull/26/head
Ross Cadogan 8 years ago
parent 69db640b98
commit 42fea79860
3 changed files with 40 additions and 145 deletions
Show Stats Download Patch File Download Diff File

24
README.md
Unescape Escape View File

@ -39,18 +39,6 @@ docker run -d \
centurylink/watchtower
```
For private images:
```
docker run -d \
--name watchtower \
-e REPO_USER="username" -e REPO_PASS="pass" -e REPO_EMAIL="email" \
-v /var/run/docker.sock:/var/run/docker.sock \
drud/watchtower container_to_watch \
--registry private.registry.net:port \
--debug
```
### Arguments
By default, watchtower will monitor all containers running within the Docker daemon to which it is pointed (in most cases this will be the local Docker daemon, but you can override it with the `--host` option described in the next section). However, you can restrict watchtower to monitoring a subset of the running containers by specifying the container names as arguments when launching watchtower.
@ -75,15 +63,11 @@ docker run --rm centurylink/watchtower --help
```
* `--host, -h` Docker daemon socket to connect to. Defaults to "unix:///var/run/docker.sock" but can be pointed at a remote Docker host by specifying a TCP endpoint as "tcp://hostname:port". The host value can also be provided by setting the `DOCKER_HOST` environment variable.
* `--registry` The private Docker registry from which to pull images, if different from `host`.
* `--interval, -i` Poll interval (in seconds). This value controls how frequently watchtower will poll for new images. Defaults to 300 seconds (5 minutes).
* `--no-pull` Do not pull new images. When this flag is specified, watchtower will not attempt to pull new images from the registry. Instead it will only monitor the local image cache for changes. Use this option if you are building new images directly on the Docker host without pushing them to a registry.
* `--cleanup` Remove old images after updating. When this flag is specified, watchtower will remove the old image after restarting a container with a new image. Use this option to prevent the accumulation of orphaned images on your system as containers are updated.
* `--tls` Use TLS when connecting to the Docker socket but do NOT verify the server's certificate. If you are connecting a TCP Docker socket protected by TLS you'll need to use either this flag or the `--tlsverify` flag (described below). The `--tlsverify` flag is preferred as it will cause the server's certificate to be verified before a connection is made.
* `--tlsverify` Use TLS when connecting to the Docker socket and verify the server's certificate. If you are connecting a TCP Docker socket protected by TLS you'll need to use either this flag or the `--tls` flag (describe above).
* `--tlscacert` Trust only certificates signed by this CA. Used in conjunction with the `--tlsverify` flag to identify the CA certificate which should be used to verify the identity of the server. The value for this flag can be either the fully-qualified path to the *.pem* file containing the CA certificate or a string containing the CA certificate itself. Defaults to "/etc/ssl/docker/ca.pem".
* `--tlscert` Client certificate for TLS authentication. Used in conjunction with the `--tls` or `--tlsverify` flags to identify the certificate to use for client authentication. The value for this flag can be either the fully-qualified path to the *.pem* file containing the client certificate or a string containing the certificate itself. Defaults to "/etc/ssl/docker/cert.pem".
* `--tlskey` Client key for TLS authentication. Used in conjunction with the `--tls` or `--tlsverify` flags to identify the key to use for client authentication. The value for this flag can be either the fully-qualified path to the *.pem* file containing the client key or a string containing the key itself. Defaults to "/etc/ssl/docker/key.pem".
* `--tlsverify` Use TLS when connecting to the Docker socket and verify the server's certificate.
* `--apiversion` Specify the minimum docker api version. watchtower will only communicate with docker servers running this api version or later.
* `--debug` Enable debug mode. When this option is specified you'll see more verbose logging in the watchtower log file.
* `--help` Show documentation about the supported flags.
@ -133,11 +117,11 @@ Note in both of the examples above that it is unnecessary to mount the */var/run
### Secure Connections
Watchtower is also capable of connecting to Docker endpoints which are protected by SSL/TLS. If you've used *docker-machine* to provision your remote Docker host, you simply need to volume mount the certificates generated by *docker-machine* into the watchtower container and specify either the `--tls` or `--tlsverify` flags.
Watchtower is also capable of connecting to Docker endpoints which are protected by SSL/TLS. If you've used *docker-machine* to provision your remote Docker host, you simply need to volume mount the certificates generated by *docker-machine* into the watchtower container and optionally specify `--tlsverify` flag.
The *docker-machine* certificates for a particular host can be located by executing the `docker-machine env` command for the desired host (note the values for the `DOCKER_HOST` and `DOCKER_CERT_PATH` environment variables that are returned from this command). The directory containing the certificates for the remote host needs to be mounted into the watchtower container at */etc/ssl/docker*.
With the certificates mounted into the watchtower container you simply need to specify either the `--tls` or `--tlsverify` flags to enable the TLS connection to the remote host:
With the certificates mounted into the watchtower container you need to specify the `--tlsverify` flag to enable verification of the certificate:
```
docker run -d \

20
container/client.go
Unescape Escape View File

@ -2,7 +2,6 @@ package container
import (
"fmt"
"os"
"time"
log "github.com/Sirupsen/logrus"
@ -15,11 +14,6 @@ const (
defaultStopSignal = "SIGTERM"
)
var username = os.Getenv("REPO_USER")
var password = os.Getenv("REPO_PASS")
var email = os.Getenv("REPO_EMAIL")
var api_version = "1.24"
// A Filter is a prototype for a function that can be used to filter the
// results from a call to the ListContainers() method on the Client.
type Filter func(Container) bool
@ -33,13 +27,16 @@ type Client interface {
RenameContainer(Container, string) error
IsContainerStale(Container) (bool, error)
RemoveImage(Container) error
RegistryLogin(string) error
}
// NewClient returns a new Client instance which can be used to interact with
// the Docker API.
func NewClient(dockerHost string, pullImages bool) Client {
cli, err := dockerclient.NewClient(dockerHost, api_version, nil, nil)
// The client reads its configuration from the following environment variables:
// * DOCKER_HOST the docker-engine host to send api requests to
// * DOCKER_TLS_VERIFY whether to verify tls certificates
// * DOCKER_API_VERSION the minimum docker api version to work with
func NewClient(pullImages bool) Client {
cli, err := dockerclient.NewEnvClient()
if err != nil {
log.Fatalf("Error instantiating Docker client: %s", err)
@ -53,11 +50,6 @@ type dockerClient struct {
pullImages bool
}
func (client dockerClient) RegistryLogin(registryURL string) error {
log.Debug("Login not implemented")
return nil
}
func (client dockerClient) ListContainers(fn Filter) ([]Container, error) {
cs := []Container{}
bg := context.Background()

141
main.go
Unescape Escape View File

@ -1,13 +1,9 @@
package main // import "github.com/CenturyLinkLabs/watchtower"
import (
"crypto/tls"
"crypto/x509"
"fmt"
"io/ioutil"
"os"
"os/signal"
"strings"
"sync"
"syscall"
"time"
@ -16,15 +12,11 @@ import (
"github.com/CenturyLinkLabs/watchtower/container"
log "github.com/Sirupsen/logrus"
"github.com/urfave/cli"
"github.com/docker/docker/api/types"
dockerclient "github.com/docker/docker/client"
"golang.org/x/net/context"
)
var (
wg sync.WaitGroup
client container.Client
registryClient container.Client
pollInterval time.Duration
cleanup bool
)
@ -34,12 +26,6 @@ func init() {
}
func main() {
rootCertPath := "/etc/ssl/docker"
if os.Getenv("DOCKER_CERT_PATH") != "" {
rootCertPath = os.Getenv("DOCKER_CERT_PATH")
}
app := cli.NewApp()
app.Name = "watchtower"
app.Usage = "Automatically update running Docker containers"
@ -52,12 +38,6 @@ func main() {
Value: "unix:///var/run/docker.sock",
EnvVar: "DOCKER_HOST",
},
cli.StringFlag{
Name: "registry",
Usage: "docker registry from which to pull images",
Value: "unix:///var/run/docker.sock",
EnvVar: "DOCKER_REGISTRY",
},
cli.IntFlag{
Name: "interval, i",
Usage: "poll interval (in seconds)",
@ -71,34 +51,20 @@ func main() {
Name: "cleanup",
Usage: "remove old images after updating",
},
cli.BoolFlag{
Name: "tls",
Usage: "use TLS; implied by --tlsverify",
},
cli.BoolFlag{
Name: "tlsverify",
Usage: "use TLS and verify the remote",
EnvVar: "DOCKER_TLS_VERIFY",
},
cli.StringFlag{
Name: "tlscacert",
Usage: "trust certs signed only by this CA",
Value: fmt.Sprintf("%s/ca.pem", rootCertPath),
},
cli.StringFlag{
Name: "tlscert",
Usage: "client certificate for TLS authentication",
Value: fmt.Sprintf("%s/cert.pem", rootCertPath),
},
cli.StringFlag{
Name: "tlskey",
Usage: "client key for TLS authentication",
Value: fmt.Sprintf("%s/key.pem", rootCertPath),
},
cli.BoolFlag{
Name: "debug",
Usage: "enable debug mode with verbose logging",
},
cli.StringFlag{
Name: "apiversion",
Usage: "the version of the docker api",
EnvVar: "DOCKER_API_VERSION",
},
}
if err := app.Run(os.Args); err != nil {
@ -114,40 +80,18 @@ func before(c *cli.Context) error {
pollInterval = time.Duration(c.Int("interval")) * time.Second
cleanup = c.GlobalBool("cleanup")
// Set-up container client
_, err := tlsConfig(c)
// configure environment vars for client
err := envConfig(c)
if err != nil {
return err
}
client = container.NewClient(c.GlobalString("host"), !c.GlobalBool("no-pull"))
//login(c)
client = container.NewClient(!c.GlobalBool("no-pull"))
handleSignals()
return nil
}
func login(c *cli.Context) {
registry := c.GlobalString("registry")
if registry != "" && registry != c.GlobalString("host") {
log.Debug("Logging into registry")
clint, err := dockerclient.NewEnvClient()
if err != nil {
panic(err)
}
regAuth := types.AuthConfig{
Username: "testuser",
Password: "testpassword",
ServerAddress: registry,
}
resp, err := clint.RegistryLogin(context.Background(), regAuth)
if err != nil {
panic(err)
}
log.Debugf("Authenticated client with registry %s, %s", registry, resp)
}
}
func start(c *cli.Context) {
names := c.Args()
@ -179,56 +123,31 @@ func handleSignals() {
}()
}
// tlsConfig translates the command-line options into a tls.Config struct
func tlsConfig(c *cli.Context) (*tls.Config, error) {
var tlsConfig *tls.Config
var err error
caCertFlag := c.GlobalString("tlscacert")
certFlag := c.GlobalString("tlscert")
keyFlag := c.GlobalString("tlskey")
if c.GlobalBool("tls") || c.GlobalBool("tlsverify") {
tlsConfig = &tls.Config{
InsecureSkipVerify: !c.GlobalBool("tlsverify"),
func setEnvOptStr(env string, opt string) error {
if (opt != "" && opt != os.Getenv(env)) {
err := os.Setenv(env, opt)
if (err != nil) {
return err
}
}
return nil
}
// Load CA cert
if caCertFlag != "" {
var caCert []byte
if strings.HasPrefix(caCertFlag, "/") {
caCert, err = ioutil.ReadFile(caCertFlag)
if err != nil {
return nil, err
}
} else {
caCert = []byte(caCertFlag)
}
caCertPool := x509.NewCertPool()
caCertPool.AppendCertsFromPEM(caCert)
func setEnvOptBool(env string, opt bool) error {
if (opt == true) {
return setEnvOptStr(env, "1")
}
return nil
}
tlsConfig.RootCAs = caCertPool
}
// envConfig translates the command-line options into environment variables
// that will initialize the api client
func envConfig(c *cli.Context) error {
var err error
// Load client certificate
if certFlag != "" && keyFlag != "" {
var cert tls.Certificate
if strings.HasPrefix(certFlag, "/") && strings.HasPrefix(keyFlag, "/") {
cert, err = tls.LoadX509KeyPair(certFlag, keyFlag)
if err != nil {
return nil, err
}
} else {
cert, err = tls.X509KeyPair([]byte(certFlag), []byte(keyFlag))
if err != nil {
return nil, err
}
}
tlsConfig.Certificates = []tls.Certificate{cert}
}
}
err = setEnvOptStr("DOCKER_HOST", c.GlobalString("host"))
err = setEnvOptBool("DOCKER_TLS_VERIFY", c.GlobalBool("tlsverify"))
err = setEnvOptStr("DOCKER_API_VERSION", c.GlobalString("apiversion"))
return tlsConfig, nil
return err
}

Write Preview
Loading…
Cancel
Save