5979d6e7e3
This adds consts for the environment variables that are supported by the client. These environment variables are unlikely to change, or at least, unlikely to be removed, but having consts allows for them to be documented. I did not change all occurrences of these variables to use the const, as they're used in various tests, and it's ok to use a fixture for those, but it's nice to have a const available for (external) consumers of the client package, and to have their purpose (and caveats) documented in the code. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
90 lines
4.8 KiB
Go
90 lines
4.8 KiB
Go
package client // import "github.com/docker/docker/client"
|
|
|
|
const (
|
|
// EnvOverrideHost is the name of the environment variable that can be used
|
|
// to override the default host to connect to (DefaultDockerHost).
|
|
//
|
|
// This env-var is read by FromEnv and WithHostFromEnv and when set to a
|
|
// non-empty value, takes precedence over the default host (which is platform
|
|
// specific), or any host already set.
|
|
EnvOverrideHost = "DOCKER_HOST"
|
|
|
|
// EnvOverrideAPIVersion is the name of the environment variable that can
|
|
// be used to override the API version to use. Value should be
|
|
// formatted as MAJOR.MINOR, for example, "1.19".
|
|
//
|
|
// This env-var is read by FromEnv and WithVersionFromEnv and when set to a
|
|
// non-empty value, takes precedence over API version negotiation.
|
|
//
|
|
// This environment variable should be used for debugging purposes only, as
|
|
// it can set the client to use an incompatible (or invalid) API version.
|
|
EnvOverrideAPIVersion = "DOCKER_API_VERSION"
|
|
|
|
// EnvOverrideCertPath is the name of the environment variable that can be
|
|
// used to specify the directory from which to load the TLS certificates
|
|
// (ca.pem, cert.pem, key.pem) from. These certificates are used to configure
|
|
// the Client for a TCP connection protected by TLS client authentication.
|
|
//
|
|
// TLS certificate verification is enabled by default if the Client is configured
|
|
// to use a TLS connection. Refer to EnvTLSVerify below to learn how to
|
|
// disable verification for testing purposes.
|
|
//
|
|
// WARNING: Access to the remote API is equivalent to root access to the
|
|
// host where the daemon runs. Do not expose the API without protection,
|
|
// and only if needed. Make sure you are familiar with the "daemon attack
|
|
// surface" (https://docs.docker.com/go/attack-surface/).
|
|
//
|
|
// For local access to the API, it is recommended to connect with the daemon
|
|
// using the default local socket connection (on Linux), or the named pipe
|
|
// (on Windows).
|
|
//
|
|
// If you need to access the API of a remote daemon, consider using an SSH
|
|
// (ssh://) connection, which is easier to set up, and requires no additional
|
|
// configuration if the host is accessible using ssh.
|
|
//
|
|
// If you cannot use the alternatives above, and you must expose the API over
|
|
// a TCP connection, refer to https://docs.docker.com/engine/security/protect-access/
|
|
// to learn how to configure the daemon and client to use a TCP connection
|
|
// with TLS client authentication. Make sure you know the differences between
|
|
// a regular TLS connection and a TLS connection protected by TLS client
|
|
// authentication, and verify that the API cannot be accessed by other clients.
|
|
EnvOverrideCertPath = "DOCKER_CERT_PATH"
|
|
|
|
// EnvTLSVerify is the name of the environment variable that can be used to
|
|
// enable or disable TLS certificate verification. When set to a non-empty
|
|
// value, TLS certificate verification is enabled, and the client is configured
|
|
// to use a TLS connection, using certificates from the default directories
|
|
// (within `~/.docker`); refer to EnvOverrideCertPath above for additional
|
|
// details.
|
|
//
|
|
// WARNING: Access to the remote API is equivalent to root access to the
|
|
// host where the daemon runs. Do not expose the API without protection,
|
|
// and only if needed. Make sure you are familiar with the "daemon attack
|
|
// surface" (https://docs.docker.com/go/attack-surface/).
|
|
//
|
|
// Before setting up your client and daemon to use a TCP connection with TLS
|
|
// client authentication, consider using one of the alternatives mentioned
|
|
// in EnvOverrideCertPath above.
|
|
//
|
|
// Disabling TLS certificate verification (for testing purposes)
|
|
//
|
|
// TLS certificate verification is enabled by default if the Client is configured
|
|
// to use a TLS connection, and it is highly recommended to keep verification
|
|
// enabled to prevent machine-in-the-middle attacks. Refer to the documentation
|
|
// at https://docs.docker.com/engine/security/protect-access/ and pages linked
|
|
// from that page to learn how to configure the daemon and client to use a
|
|
// TCP connection with TLS client authentication enabled.
|
|
//
|
|
// Set the "DOCKER_TLS_VERIFY" environment to an empty string ("") to
|
|
// disable TLS certificate verification. Disabling verification is insecure,
|
|
// so should only be done for testing purposes. From the Go documentation
|
|
// (https://pkg.go.dev/crypto/tls#Config):
|
|
//
|
|
// InsecureSkipVerify controls whether a client verifies the server's
|
|
// certificate chain and host name. If InsecureSkipVerify is true, crypto/tls
|
|
// accepts any certificate presented by the server and any host name in that
|
|
// certificate. In this mode, TLS is susceptible to machine-in-the-middle
|
|
// attacks unless custom verification is used. This should be used only for
|
|
// testing or in combination with VerifyConnection or VerifyPeerCertificate.
|
|
EnvTLSVerify = "DOCKER_TLS_VERIFY"
|
|
)
|