From 91f1e172bb9862b5a20c3c308401feb52d6dccf1 Mon Sep 17 00:00:00 2001 From: Dean Chen <862469039@qq.com> Date: Sun, 16 Aug 2026 23:44:07 +0500 Subject: [PATCH 1/2] docs: say HTTPS, not HTTP, for the TLS daemon socket The section is about TLS. Calling it HTTP was the opposite of the point. Signed-off-by: Dean Chen <862469039@qq.com> --- content/manuals/engine/security/protect-access.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/manuals/engine/security/protect-access.md b/content/manuals/engine/security/protect-access.md index c4066f3259ec..77bf60bcfa10 100644 --- a/content/manuals/engine/security/protect-access.md +++ b/content/manuals/engine/security/protect-access.md @@ -77,7 +77,7 @@ ControlPersist yes ## Use TLS (HTTPS) to protect the Docker daemon socket -If you need Docker to be reachable through HTTP rather than SSH in a safe manner, +If you need Docker to be reachable through HTTPS rather than SSH, you can enable TLS (HTTPS) by specifying the `tlsverify` flag and pointing Docker's `tlscacert` flag to a trusted CA certificate. From 79e5622bb924fe4c5858fb947dc6040e2181e49c Mon Sep 17 00:00:00 2001 From: Dean Chen <862469039@qq.com> Date: Mon, 17 Aug 2026 07:47:19 +0500 Subject: [PATCH 2/2] docs: --tls still needs the CA file The client modes list said --tls used the public CA pool. The CLI always loads --tlscacert (default ~/.docker/ca.pem) and errors if it's missing. Signed-off-by: Dean Chen <862469039@qq.com> --- .../manuals/engine/security/protect-access.md | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/content/manuals/engine/security/protect-access.md b/content/manuals/engine/security/protect-access.md index 77bf60bcfa10..c61bdba232c9 100644 --- a/content/manuals/engine/security/protect-access.md +++ b/content/manuals/engine/security/protect-access.md @@ -315,12 +315,17 @@ Docker in various other modes by mixing the flags. #### Client modes - - `tls`: Authenticate server based on public/default CA pool - - `tlsverify`, `tlscacert`: Authenticate server based on given CA - - `tls`, `tlscert`, `tlskey`: Authenticate with client certificate, do not - authenticate server based on given CA - - `tlsverify`, `tlscacert`, `tlscert`, `tlskey`: Authenticate with client - certificate and authenticate server based on given CA +- `tls`: Enable TLS. The client still loads `--tlscacert` (default + `~/.docker/ca.pem`) and fails if that file is missing. It does not use + the system CA pool. Without `--tlsverify`, the daemon certificate is + not verified. +- `tlsverify`, `tlscacert`: Enable TLS and verify the daemon against the + given CA +- `tls`, `tlscert`, `tlskey`: Present a client certificate. Still loads + `--tlscacert` as above. The daemon certificate is not verified unless + `--tlsverify` is also set +- `tlsverify`, `tlscacert`, `tlscert`, `tlskey`: Present a client + certificate and verify the daemon against the given CA If found, the client sends its client certificate, so you just need to drop your keys into `~/.docker/{ca,cert,key}.pem`. Alternatively,