Переглянути джерело

docker-login man/doc add security info

Signed-off-by: Sally O'Malley <somalley@redhat.com>
Sally O'Malley 9 роки тому
батько
коміт
f9657819cd
2 змінених файлів з 22 додано та 0 видалено
  1. 13 0
      docs/reference/commandline/login.md
  2. 9 0
      man/docker-login.1.md

+ 13 - 0
docs/reference/commandline/login.md

@@ -25,3 +25,16 @@ adding the server name.
 
     example:
     $ docker login localhost:8080
+
+
+`docker login` requires user to use `sudo` or be `root`, except when: 
+
+1.  connecting to a remote daemon, such as a `docker-machine` provisioned `docker engine`.
+2.  user is added to the `docker` group.  This will impact the security of your system; the `docker` group is `root` equivalent.  See [Docker Daemon Attack Surface](https://docs.docker.com/articles/security/#docker-daemon-attack-surface) for details. 
+
+You can log into any public or private repository for which you have
+credentials.  When you log in, the command stores encoded credentials in
+`$HOME/.docker/config.json` on Linux or `%USERPROFILE%/.docker/config.json` on Windows.
+
+> **Note**:  When running `sudo docker login` credentials are saved in `/root/.docker/config.json`.
+>

+ 9 - 0
man/docker-login.1.md

@@ -18,10 +18,18 @@ Register or log in to a Docker Registry located on the specified
 do not specify a `SERVER`, the command uses Docker's public registry located at
 `https://registry-1.docker.io/` by default.  To get a username/password for Docker's public registry, create an account on Docker Hub.
 
+`docker login` requires user to use `sudo` or be `root`, except when: 
+
+1.  connecting to  a remote daemon, such as a `docker-machine` provisioned `docker engine`.
+2.  user is added to the `docker` group.  This will impact the security of your system; the `docker` group is `root` equivalent.  See [Docker Daemon Attack Surface](https://docs.docker.com/articles/security/#docker-daemon-attack-surface) for details. 
+
 You can log into any public or private repository for which you have
 credentials.  When you log in, the command stores encoded credentials in
 `$HOME/.docker/config.json` on Linux or `%USERPROFILE%/.docker/config.json` on Windows.
 
+> **Note**: When running `sudo docker login` credentials are saved in `/root/.docker/config.json`.
+>
+
 # OPTIONS
 **-e**, **--email**=""
    Email
@@ -49,3 +57,4 @@ April 2014, Originally compiled by William Henry (whenry at redhat dot com)
 based on docker.com source material and internal work.
 June 2014, updated by Sven Dowideit <SvenDowideit@home.org.au>
 April 2015, updated by Mary Anthony for v2 <mary@docker.com>
+November 2015, updated by Sally O'Malley <somalley@redhat.com>