Docker配置遠程idea使用

  • 生成證書參考如下

$ HOST=example.com
$ openssl genrsa -aes256 -out ca-key.pem 4096
Generating RSA private key, 4096 bit long modulus (2 primes)
..........++++
.........................................................................................................................................................................................++++
e is 65537 (0x010001)
Enter pass phrase for ca-key.pem:
Verifying - Enter pass phrase for ca-key.pem:
$ openssl req -new -x509 -days 365 -key ca-key.pem -sha256 -out ca.pem
Enter pass phrase for ca-key.pem:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:Beijing
Locality Name (eg, city) []:Chaoyang
Organization Name (eg, company) [Internet Widgits Pty Ltd]:ZNH
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:
Email Address []:alayama@163.com
$ openssl genrsa -out server-key.pem 4096
Generating RSA private key, 4096 bit long modulus (2 primes)
........................................................................................................................................................++++
...............................................++++
e is 65537 (0x010001)
$ openssl req -subj "/CN=$HOST" -sha256 -new -key server-key.pem -out server.csr
$ echo subjectAltName = DNS:$HOST,IP:127.0.0.1 >> extfile.cnf
$ echo extendedKeyUsage = serverAuth >> extfile.cnf
$ openssl x509 -req -days 365 -sha256 -in server.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out server-cert.pem -extfile extfile.cnf
Signature ok
subject=CN = example.com
Getting CA Private Key
Enter pass phrase for ca-key.pem:
$ openssl genrsa -out key.pem 4096
Generating RSA private key, 4096 bit long modulus (2 primes)
.........................................................................................................................................................................................++++
................++++
e is 65537 (0x010001)
$ openssl req -subj '/CN=client' -new -key key.pem -out client.csr
$ echo extendedKeyUsage = clientAuth > extfile-client.cnf
$ openssl x509 -req -days 365 -sha256 -in client.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out cert.pem -extfile extfile-client.cnf
Signature ok
subject=CN = client
Getting CA Private Key
Enter pass phrase for ca-key.pem:
$ rm -v client.csr server.csr extfile.cnf extfile-client.cnf
rm: remove regular file ‘client.csr’? y
removed ‘client.csr’
rm: remove regular file ‘server.csr’? y
removed ‘server.csr’
rm: remove regular file ‘extfile.cnf’? y
removed ‘extfile.cnf’
rm: remove regular file ‘extfile-client.cnf’? y
removed ‘extfile-client.cnf’
$ chmod -v 0400 ca-key.pem key.pem server-key.pem
mode of ‘ca-key.pem’ changed from 0600 (rw-------) to 0400 (r--------)
mode of ‘key.pem’ changed from 0600 (rw-------) to 0400 (r--------)
mode of ‘server-key.pem’ changed from 0600 (rw-------) to 0400 (r--------)
$ chmod -v 0444 ca.pem server-cert.pem cert.pem
mode of ‘ca.pem’ changed from 0644 (rw-r--r--) to 0444 (r--r--r--)
mode of ‘server-cert.pem’ changed from 0644 (rw-r--r--) to 0444 (r--r--r--)
mode of ‘cert.pem’ changed from 0644 (rw-r--r--) to 0444 (r--r--r--)

-####生成證書的命令詳解

  • 綁定IP或者域名
    把下面的$Host換成你自己服務器外網(wǎng)的IP或者域名:比如:openssl req -subj “/CN=192.168.1.0” -sha256…

或:openssl req -subj “/CN=www.laohan.com” -sha256…(這么做前提是你有域名,該域名DNS解析后指向你的服務器)

openssl req -subj "/CN=$HOST" -sha256 -new -key server-key.pem -out server.csr
  • 配置白名單
    接下來要允許那些ip可以連接到服務器的docker,因為已經(jīng)是ssl連接,所以我推薦配置0.0.0.0,也就是所有Ip都可以連接(但只有擁有證書的才可以連接成功),這樣配置好之后公司其他人也可以使用.如果你不想這樣,那你可以配置Ip,用逗號分隔開.下面的$Host依舊是你服務器外網(wǎng)的IP或者域名,請自行替換.（這里如果你使用的是服務器Ip的話,請將前面的DNS換成IP,否則配下來連接還是不會成功,如果你使用的是服務器域名,那么就用DNS就可以了)
echo subjectAltName = DNS:$HOST,IP:0.0.0.0 >> extfile.cnf

  • 配置docker使用加密方式

$ vim /usr/lib/systemd/system/docker.service
...第左右13行
ExecStart=/usr/bin/dockerd -H fd:// \
    --tlsverify --tlscacert=/data/docker_cert/ca.pem \
    --tlscert=/data/docker_cert/server-cert.pem \
    --tlskey=/data/docker_cert/server-key.pem \
    -H tcp://0.0.0.0:2376 \
    --containerd=/run/containerd/containerd.sock
...
$ service docker restart

可以在瀏覽器使用https://$HOST:PORT進行測試，如果提示證書不正確說明配置成功，只有拿到證書的客戶端才可以訪問遠程docker服務。

image.png

  • IDEA連接遠程Docker

將ca.pem，cert.pem，key.pem三個證書下載到本地。

在IDEA中打開File->Settings->Docker，填寫URL和證書目錄，


image.png

image.png

  • 配置maven docker插件

<plugin>
    <groupId>io.fabric8</groupId>
    <artifactId>docker-maven-plugin</artifactId>
</plugin>
###具體配置如下

<plugin>
    <groupId>io.fabric8</groupId>
    <artifactId>docker-maven-plugin</artifactId>
    <version>0.39.1</version>
    <configuration>
        <certPath>C:\Code\cert</certPath>
        <dockerHost>https://xxxxxxxxxx:9092</dockerHost>
        <useColor>true</useColor>
        <images>
            <image>
                <alias>${project.name}</alias>
                <name>lymboy/${project.name}</name>
                <build>
                    <from>ccr.ccs.tencentyun.com/lymboy/java8:1.0</from>
                    <maintainer>alayama@163.com</maintainer>
                    <tags>
                        <tag>${project.version}</tag>
                    </tags>
                    <workdir>/opt/</workdir>
                    <ports>
                        <port>8080</port>
                    </ports>
                    <entryPoint>
                        <exec>
                            <arg>java</arg>
                            <arg>-jar</arg>
                            <arg>/opt/${project.name}.jar</arg>
                        </exec>
                    </entryPoint>
                    <assembly>
                        <mode>dir</mode>
                        <targetDir>/opt</targetDir>
                        <descriptorRef>artifact</descriptorRef>
                    </assembly>
                </build>
            </image>
        </images>
    </configuration>
    <dependencies>
        <dependency>
            <groupId>commons-codec</groupId>
            <artifactId>commons-codec</artifactId>
            <version>1.15</version>
        </dependency>
    </dependencies>
</plugin>

添加上述maven插件后，通過maven命令就可以直接將項目構建成docker鏡像并推送到遠程docker服務。

mvn clean package -Dfile.encoding=UTF-8 docker:build

上述的插件配置等價于如下Dockerfile

FROM ccr.ccs.tencentyun.com/lymboy/java8:1.0
MAINTAINER alayama@163.com
EXPOSE 8080
COPY maven /opt/
WORKDIR /opt/
ENTRYPOINT ["java","-jar","/opt/example.jar"]

當應用鏡像推送到遠程docker服務后，可以在IDEA Services直接運行指定的鏡像。

image.png

參開出處：(35條消息) Docker配置遠程訪問_lymboy的博客-CSDN博客_docker配置遠程連接

?著作權歸作者所有,轉載或內(nèi)容合作請聯(lián)系作者
【社區(qū)內(nèi)容提示】社區(qū)部分內(nèi)容疑似由AI輔助生成，瀏覽時請結合常識與多方信息審慎甄別。
平臺聲明：文章內(nèi)容（如有圖片或視頻亦包括在內(nèi)）由作者上傳并發(fā)布，文章內(nèi)容僅代表作者本人觀點，簡書系信息發(fā)布平臺，僅提供信息存儲服務。

相關閱讀更多精彩內(nèi)容

友情鏈接更多精彩內(nèi)容