[{"data":1,"prerenderedAt":3073},["ShallowReactive",2],{"navigation":3,"\u002Fdocs\u002Fdocker\u002Fusage\u002Fconnect-remote-docker":158,"\u002Fdocs\u002Fdocker\u002Fusage\u002Fconnect-remote-docker-description":3062},[4],{"title":5,"path":6,"stem":7,"children":8,"page":36},"Docs","\u002Fdocs","docs",[9,37,45,65,148],{"title":10,"description":11,"icon":12,"path":13,"stem":14,"children":15,"page":36},"Redis","Redis是一个开源的高性能键值存储数据库，它提供了多种数据结构来存储数据，如字符串、哈希、列表、集合、有序集合等。Redis将数据存储在内存中，以提供快速的读写访问速度，并且能够通过异步的方式将数据持久化到磁盘上。它支持复制、Lua脚本、事务处理、不同级别的持久化选项以及多种客户端语言的接口。Redis广泛用于缓存、消息队列、短时数据存储和高性能的应用场景中。","skill-icons:redis-light","\u002Fdocs\u002Fredis","docs\u002F1.redis",[16],{"title":17,"path":18,"stem":19,"children":20,"description":34,"icon":35},"install","\u002Fdocs\u002Fredis\u002Finstall","docs\u002F1.redis\u002F1.install\u002F1.index",[21,24,29],{"title":22,"path":18,"stem":19,"description":23},"Introduction","The powerful Git-based CMS designed specifically for Nuxt developers.",{"title":25,"path":26,"stem":27,"description":28},"Installation","\u002Fdocs\u002Fredis\u002Finstall\u002Finstallation","docs\u002F1.redis\u002F1.install\u002F2.installation","Get started with Nuxt Content v3 in your Nuxt application.",{"title":30,"path":31,"stem":32,"description":33},"Configuration","\u002Fdocs\u002Fredis\u002Finstall\u002Fconfiguration","docs\u002F1.redis\u002F1.install\u002F3.configuration","Nuxt Content is configured with sensible defaults.",null,"icon-park-outline:install",false,{"title":38,"path":39,"stem":40,"children":41,"description":43,"icon":44},"SpringBoot","\u002Fdocs\u002Fspringboot","docs\u002F2.springboot\u002F1.index",[42],{"title":22,"path":39,"stem":40,"description":23},"Spring Boot 是一个基于 Spring 框架的‌开箱即用型 Java 开发框架‌，由 Pivotal 团队于 2014 年推出，旨在彻底简化 Spring 应用的初始搭建、配置和部署流程。其核心理念是 ‌\"约定优于配置\"‌，通过自动化机制减少开发者的样板代码工作，显著提升效率。","simple-icons:springboot",{"title":46,"path":47,"stem":48,"children":49,"description":63,"icon":64},"Rocky Linux","\u002Fdocs\u002Frocky","docs\u002F3.rocky\u002F1.index",[50,53,58],{"title":51,"path":47,"stem":48,"description":52},"1 Rocky Linux 概述","Rocky Linux 是一个开源、免费的企业级 Linux 操作系统。它的核心目标是与 Red Hat Enterprise Linux (RHEL) 100% 完全兼容，可以看作是原本广受欢迎的 CentOS 的“替代者”和“精神继承者.",{"title":54,"path":55,"stem":56,"description":57},"2 VMware安装Rocky Linux","\u002Fdocs\u002Frocky\u002Finstall","docs\u002F3.rocky\u002F2.install","本文主要介绍了VMware Workstation 17.x 虚拟机如何快速安装Rocky Linux 10.x 版本的Linux操作系统。",{"title":59,"path":60,"stem":61,"description":62},"3 Rocky Linux 10安装Docker","\u002Fdocs\u002Frocky\u002Fdocker","docs\u002F3.rocky\u002F3.docker","在 Rocky Linux 10 上安装 Docker 的推荐方式是使用其官方仓库。下面是完整的安装步骤。","Rocky Linux 是一个开源、免费的企业级 Linux 操作系统。它的核心目标是与 Red Hat Enterprise Linux (RHEL) 100% 完全兼容，可以看作是原本广受欢迎的 CentOS 的“替代者”和“精神继承者”","logos:rocky-linux-icon",{"title":66,"description":67,"icon":68,"path":69,"stem":70,"children":71,"page":36},"Docker","Docker是一个开源的应用容器引擎，可以让开发者打包他们的应用以及依赖包到一个轻量级、可移植的容器中，然后发布到Docker容器中运行，也可以实现虚拟化。","devicon:docker","\u002Fdocs\u002Fdocker","docs\u002F4.docker",[72,96,111,137],{"title":73,"path":74,"stem":75,"children":76,"description":34,"icon":95},"Docker 基础","\u002Fdocs\u002Fdocker\u002Fbasic","docs\u002F4.docker\u002F1.basic\u002F1.index",[77,80,85,90],{"title":78,"path":74,"stem":75,"description":79},"Docker基础概念","Docker是一个基于Go语言开发并遵从 Apache2.0 协议开源的应用容器引擎，可以让开发者打包他们的应用以及依赖包到一个轻量级、可移植的容器中，然后发布到Docker环境中运行，容器彼此隔离，但可以通过特定的通道相互传递信息。保证了在任何环境下运行的应用程序具有相同的行为，这极大地减少了环境差异导致的“在我机器上可以运行”的问题。",{"title":81,"path":82,"stem":83,"description":84},"Docker核心架构","\u002Fdocs\u002Fdocker\u002Fbasic\u002Fdocker-architecture","docs\u002F4.docker\u002F1.basic\u002F2.docker-architecture","Docker 采用 C\u002FS 架构，客户端通过 REST API 将指令下达给常驻后台的守护进程（dockerd）；守护进程则依靠 Linux 内核的 Namespace 实现环境隔离、Cgroups 实现资源配额，并利用 UnionFS 的分层存储机制构建镜像和容器，从而在单台宿主机上实现了轻量级、高性能的应用沙箱。",{"title":86,"path":87,"stem":88,"description":89},"Docker镜像加速","\u002Fdocs\u002Fdocker\u002Fbasic\u002Fdocker-mirror-acceleration","docs\u002F4.docker\u002F1.basic\u002F3.docker-mirror-acceleration","Docker安装完成后默认的官方镜像仓库是[Docker Hub‌](https:\u002F\u002Fhub.docker.com\u002F){target=blank}，这是Docker官方维护的公共镜像注册中心。但对于国内Docker用户而言，在没有魔法的情况下是无法访问Docker Hub网站的，也无法从Docker Hub仓库拉取镜像。目前国内常用的2种方法：**Docker镜像加速源** 和 **配置Docker代理**。",{"title":91,"path":92,"stem":93,"description":94},"Docker Context","\u002Fdocs\u002Fdocker\u002Fbasic\u002Fdocker-context","docs\u002F4.docker\u002F1.basic\u002F4.docker-context","Docker Context 是 Docker 19.03 版本引入的一项功能，它为 Docker 客户端（CLI）提供了一套标准化的“连接配置”机制。通过 Context，你可以轻松地在本地开发环境、远程服务器、云服务等多个 Docker 环境之间快速切换，极大地提升了多环境管理的效率。","mdi:information-box-outline",{"title":97,"description":34,"icon":35,"path":98,"stem":99,"children":100,"page":36},"Docker 安装","\u002Fdocs\u002Fdocker\u002Finstall","docs\u002F4.docker\u002F2.install",[101,106],{"title":102,"path":103,"stem":104,"description":105},"CentOS安装Docker","\u002Fdocs\u002Fdocker\u002Finstall\u002Fcentos-docker-install","docs\u002F4.docker\u002F2.install\u002F1.centos-docker-install","在 CentOS 上安装 Docker，准确的说是安装 Docker Engine, 本文主要介绍如何在CentOS上安装Docker。",{"title":107,"path":108,"stem":109,"description":110},"Rocky安装Docker","\u002Fdocs\u002Fdocker\u002Finstall\u002Frocky-docker-install","docs\u002F4.docker\u002F2.install\u002F2.rocky-docker-install","在 Rocky Linux 10 上安装 Docker 和 Centos 安装 Docker 步骤基本类似的，推荐方式是使用其官方仓库。下面是完整的安装步骤。",{"title":112,"description":34,"icon":113,"path":114,"stem":115,"children":116,"page":36},"Docker 使用","fluent:data-usage-24-regular","\u002Fdocs\u002Fdocker\u002Fusage","docs\u002F4.docker\u002F3.usage",[117,122,127,132],{"title":118,"path":119,"stem":120,"description":121},"Docker持久化","\u002Fdocs\u002Fdocker\u002Fusage\u002Fdocker-persistence","docs\u002F4.docker\u002F3.usage\u002F1.docker-persistence","在 Docker 中，容器默认是无状态的，容器删除后内部数据会直接丢失，Docker 官方提供了三类核心数据持久化方案，分别适配不同的使用场景：卷（Volumes）、绑定挂载（Bind Mounts） 和 tmpfs 挂载。",{"title":123,"path":124,"stem":125,"description":126},"Docker容器自启动","\u002Fdocs\u002Fdocker\u002Fusage\u002Fcontainer-restart","docs\u002F4.docker\u002F3.usage\u002F2.container-restart","Docker容器自启动策略是指Docker服务运行期间，特定容器在退出、崩溃或宿主机重启后，容器是否自动重新运行。",{"title":128,"path":129,"stem":130,"description":131},"Docker Dockerfile","\u002Fdocs\u002Fdocker\u002Fusage\u002Fdocker-dockerfile","docs\u002F4.docker\u002F3.usage\u002F3.docker-dockerfile","本文旨在探讨Dockerfile的功能定位与指令体系，并在此基础上，给出基于Dockerfile实现自定义镜像构建的具体方法。",{"title":133,"path":134,"stem":135,"description":136},"连接远程Docker服务","\u002Fdocs\u002Fdocker\u002Fusage\u002Fconnect-remote-docker","docs\u002F4.docker\u002F3.usage\u002F4.connect-remote-docker","在日常开发或测试中，我们经常需要在本地开发环境中直接操作远程 Docker 服务——执行镜像构建、容器启停等命令，效果与直接在远程服务器上操作完全一致。这能极大提升调试与部署效率，同时避免频繁登录远程服务器的繁琐。",{"title":138,"description":34,"icon":139,"path":140,"stem":141,"children":142,"page":36},"Docker 参考手册","material-symbols-light:docs-outline","\u002Fdocs\u002Fdocker\u002Fresources","docs\u002F4.docker\u002F5.resources",[143],{"title":144,"path":145,"stem":146,"description":147},"Docker 命令大全","\u002Fdocs\u002Fdocker\u002Fresources\u002Fdocker-command","docs\u002F4.docker\u002F5.resources\u002F1.docker-command","下面介绍Docker常见的基础命令。",{"title":149,"path":150,"stem":151,"children":152,"description":156,"icon":157},"Linux","\u002Fdocs\u002Flinux","docs\u002F5.Linux\u002F1.index",[153],{"title":154,"path":150,"stem":151,"description":155},"1.dnf和yum区别","一句话概括：dnf 是 yum 的下一代升级版，你可以把 dnf 看作\"优化重构后的yum\"","Linux是免费开源、多用户多任务、高稳定性与安全性、支持多平台硬件的Unix操作系统。文档整理了Linux相关的命令和常见问题处理方法。","logos:linux-tux",{"id":159,"title":160,"body":161,"createDate":3052,"description":136,"extension":3053,"links":34,"meta":3054,"navigation":3055,"path":134,"readingTime":3056,"seo":3057,"sitemap":3058,"stem":135,"updateDate":3059,"wordCount":3060,"__hash__":3061},"docs\u002Fdocs\u002F4.docker\u002F3.usage\u002F4.connect-remote-docker.md","如何连接远程Docker服务",{"type":162,"value":163,"toc":3019},"minimark",[164,168,185,194,199,202,246,250,253,315,321,325,328,333,336,344,349,355,364,527,534,641,645,648,659,665,669,672,684,687,691,694,714,718,721,728,731,738,754,761,822,827,834,861,868,871,878,895,902,924,931,954,958,961,984,987,991,994,999,1028,1033,1063,1068,1072,1075,1079,1082,1090,1111,1119,1143,1155,1189,1197,1215,1223,1258,1266,1305,1313,1364,1371,1389,1396,1429,1436,1456,1463,1506,1513,1532,1540,1577,1585,1647,1651,1658,1669,1677,1691,1694,1824,1842,1849,1852,1866,1869,1901,1906,1913,1935,1943,1967,1971,1974,1978,1986,2030,2033,2041,2046,2074,2079,2096,2101,2113,2118,2143,2148,2164,2168,2174,2199,2202,2208,2213,2248,2252,2268,2272,2282,2286,2300,2304,2307,2315,2323,2331,2360,2363,2371,2549,2557,2652,2656,2663,2674,2678,2689,2692,2696,2702,2712,2762,2765,2770,2774,2777,2788,2792,2854,2858,2941,2945,2948,3015],[165,166,167],"p",{},"本文介绍两种场景下的连接配置方法：",[169,170,171,179],"ul",{},[172,173,174,178],"li",{},[175,176,177],"strong",{},"场景一："," 本地终端（命令行）连接远程 Docker。",[172,180,181,184],{},[175,182,183],{},"场景二："," VSCode 通过 Container Tools 插件连接远程 Docker。",[186,187,191],"callout",{"color":188,"icon":189,"target":190,"to":92},"info","i-lucide-square-play","primary",[165,192,193],{},"核心建议：无论哪种场景，均推荐使用 Docker Context 统一管理连接配置，实现多环境一键切换。如需深入了解 Docker Context 的详细用法，请访问对应章节。",[195,196,198],"h2",{"id":197},"_1-通用前置条件","1. 通用前置条件",[165,200,201],{},"在开始配置之前，请确保满足以下基础条件：",[203,204,205,218],"table",{},[206,207,208],"thead",{},[209,210,211,215],"tr",{},[212,213,214],"th",{},"条件",[212,216,217],{},"要求",[219,220,221,230,238],"tbody",{},[209,222,223,227],{},[224,225,226],"td",{},"本地环境",[224,228,229],{},"已安装 Docker CLI（通过 docker --version 验证），无需安装 Docker Daemon",[209,231,232,235],{},[224,233,234],{},"远程服务",[224,236,237],{},"Docker 服务正常运行（systemctl status docker），当前用户有权限访问 \u002Fvar\u002Frun\u002Fdocker.sock（通常需加入 docker 组）",[209,239,240,243],{},[224,241,242],{},"网络环境",[224,244,245],{},"本地能访问远程服务器的对应端口（SSH 默认 22，TCP 自定义端口如 2375\u002F2376）",[195,247,249],{"id":248},"_2-连接方案选型","2. 连接方案选型",[165,251,252],{},"根据安全需求和网络环境，三种连接方式对比如下：",[203,254,255,271],{},[206,256,257],{},[209,258,259,262,265,268],{},[212,260,261],{},"连接方式",[212,263,264],{},"安全性",[212,266,267],{},"服务端配置复杂度",[212,269,270],{},"适用场景",[219,272,273,287,301],{},[209,274,275,278,281,284],{},[224,276,277],{},"SSH隧道",[224,279,280],{},"★★★★★（SSH加密）",[224,282,283],{},"无需额外配置",[224,285,286],{},"开发测试、日常管理（首选）",[209,288,289,292,295,298],{},[224,290,291],{},"TCP明文",[224,293,294],{},"★☆☆☆☆（极低）",[224,296,297],{},"中（修改配置 + 开放端口）",[224,299,300],{},"仅限内网隔离测试环境",[209,302,303,306,309,312],{},[224,304,305],{},"TCP + TLS",[224,307,308],{},"★★★★★（TLS加密）",[224,310,311],{},"高（生成证书 + 修改配置 + 开放端口）",[224,313,314],{},"生产环境、跨公网访问",[316,317,318],"warning",{},[165,319,320],{},"强烈建议：除非有特殊原因，优先选择 SSH 方式，安全且无需额外配置。",[195,322,324],{"id":323},"_3-服务端配置","3. 服务端配置",[165,326,327],{},"根据选择的连接方式，在远程服务器上进行相应配置。",[329,330,332],"h3",{"id":331},"_31-ssh-隧道方式","3.1 SSH 隧道方式",[165,334,335],{},"SSH 是管理远程 Docker 最安全、最便捷的方式，尤其适合公有云 ECS 或需要穿越防火墙的场景。SSH 方式复用现有的 SSH 基础设施（密钥认证、加密通道），无需额外配置 TLS 证书，Docker 服务端无需任何额外配置。只需确保：",[169,337,338,341],{},[172,339,340],{},"远程服务器已开启 SSH 服务（默认 22 端口）且用户有权限访问 Docker socket。",[172,342,343],{},"本地已配置好 SSH 免密登录（使用密钥对），因为 Docker CLI 在非交互环境下无法输入密码。",[345,346,348],"h4",{"id":347},"_311-配置ssh免密登录","3.1.1 配置SSH免密登录",[165,350,351,354],{},[175,352,353],{},"SSH免密登录的核心原理","是采用非对称加密算法，生成一对秘钥，它通过客户端的私钥和服务器端的公钥进行身份配对，从而代替传统的密码输入。",[356,357,358],"ol",{},[172,359,360,363],{},[175,361,362],{},"Windows 系统："," Windows 10\u002F11 系统通常已内置 OpenSSH 客户端，可以直接使用。",[169,365,366,414],{},[172,367,368,371,376,409],{},[175,369,370],{},"生成 SSH 密钥对（如果还没有）",[169,372,373],{},[172,374,375],{},"以管理员身份打开 PowerShell，执行生成密钥命令：",[377,378,383],"pre",{"className":379,"code":380,"language":381,"meta":382,"style":382},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","ssh-keygen -t rsa -b 4096\n","bash","",[384,385,386],"code",{"__ignoreMap":382},[387,388,391,395,399,402,405],"span",{"class":389,"line":390},"line",1,[387,392,394],{"class":393},"sBMFI","ssh-keygen",[387,396,398],{"class":397},"sfazB"," -t",[387,400,401],{"class":397}," rsa",[387,403,404],{"class":397}," -b",[387,406,408],{"class":407},"sbssI"," 4096\n",[169,410,411],{},[172,412,413],{},"全程按 Enter 键采用默认值（含空密码）。执行完成后会在 C:\\Users\u003C你的用户名>.ssh 目录下生成 id_rsa私钥 和 id_rsa.pub公钥。",[172,415,416,419],{},[175,417,418],{},"将公钥手动上传到远程服务器",[377,420,422],{"className":379,"code":421,"language":381,"meta":382,"style":382},"# 1. 创建 .ssh 目录（如果不存在）\nmkdir -p ~\u002F.ssh\n\n# 2. 将公钥内容追加到 authorized_keys 文件\necho \"这里粘贴你刚刚复制的公钥内容\" >> ~\u002F.ssh\u002Fauthorized_keys\n\n# 3. 设置正确的权限\nchmod 700 ~\u002F.ssh\nchmod 600 ~\u002F.ssh\u002Fauthorized_keys\n\n# 4. 退出服务器\nexit\n",[384,423,424,430,442,449,455,478,483,489,500,510,515,521],{"__ignoreMap":382},[387,425,426],{"class":389,"line":390},[387,427,429],{"class":428},"sHwdD","# 1. 创建 .ssh 目录（如果不存在）\n",[387,431,433,436,439],{"class":389,"line":432},2,[387,434,435],{"class":393},"mkdir",[387,437,438],{"class":397}," -p",[387,440,441],{"class":397}," ~\u002F.ssh\n",[387,443,445],{"class":389,"line":444},3,[387,446,448],{"emptyLinePlaceholder":447},true,"\n",[387,450,452],{"class":389,"line":451},4,[387,453,454],{"class":428},"# 2. 将公钥内容追加到 authorized_keys 文件\n",[387,456,458,462,466,469,472,475],{"class":389,"line":457},5,[387,459,461],{"class":460},"s2Zo4","echo",[387,463,465],{"class":464},"sMK4o"," \"",[387,467,468],{"class":397},"这里粘贴你刚刚复制的公钥内容",[387,470,471],{"class":464},"\"",[387,473,474],{"class":464}," >>",[387,476,477],{"class":397}," ~\u002F.ssh\u002Fauthorized_keys\n",[387,479,481],{"class":389,"line":480},6,[387,482,448],{"emptyLinePlaceholder":447},[387,484,486],{"class":389,"line":485},7,[387,487,488],{"class":428},"# 3. 设置正确的权限\n",[387,490,492,495,498],{"class":389,"line":491},8,[387,493,494],{"class":393},"chmod",[387,496,497],{"class":407}," 700",[387,499,441],{"class":397},[387,501,503,505,508],{"class":389,"line":502},9,[387,504,494],{"class":393},[387,506,507],{"class":407}," 600",[387,509,477],{"class":397},[387,511,513],{"class":389,"line":512},10,[387,514,448],{"emptyLinePlaceholder":447},[387,516,518],{"class":389,"line":517},11,[387,519,520],{"class":428},"# 4. 退出服务器\n",[387,522,524],{"class":389,"line":523},12,[387,525,526],{"class":460},"exit\n",[356,528,529],{"start":432},[172,530,531],{},[175,532,533],{},"Linux \u002F macOS 系统",[169,535,536,566],{},[172,537,538,540,545,561],{},[175,539,370],{},[169,541,542],{},[172,543,544],{},"打开终端（Terminal），运行以下命令",[377,546,547],{"className":379,"code":380,"language":381,"meta":382,"style":382},[384,548,549],{"__ignoreMap":382},[387,550,551,553,555,557,559],{"class":389,"line":390},[387,552,394],{"class":393},[387,554,398],{"class":397},[387,556,401],{"class":397},[387,558,404],{"class":397},[387,560,408],{"class":407},[169,562,563],{},[172,564,565],{},"整个执行过程直接按 Enter 键，一切采用默认值，包括空密码——因为 Docker 无法交互式输入密码，设置密码会导致连接失败。执行完成后会在 ~\u002F.ssh 目录下生成 id_rsa（私钥）和 id_rsa.pub（公钥）。",[172,567,568,571,572,580,599,604,612],{},[175,569,570],{},"将公钥复制到远程服务器："," 你需要将本地的公钥（id_rsa.pub 文件）内容，追加到远程服务器对应用户家目录的 ~\u002F.ssh\u002Fauthorized_keys 文件中。根据你使用的操作系统，选择以下任意一种最方便的方法：\n",[169,573,574],{},[172,575,576,579],{},[175,577,578],{},"方法 A："," 使用 ssh-copy-id 自动复制（最推荐，简单安全），Linux 自带该工具。macOS 用户若未安装，可先通过 Homebrew 运行 brew install ssh-copy-id 安装。",[377,581,583],{"className":379,"code":582,"language":381,"meta":382,"style":382},"ssh-copy-id -i ~\u002F.ssh\u002Fid_rsa.pub username@remote_host\n",[384,584,585],{"__ignoreMap":382},[387,586,587,590,593,596],{"class":389,"line":390},[387,588,589],{"class":393},"ssh-copy-id",[387,591,592],{"class":397}," -i",[387,594,595],{"class":397}," ~\u002F.ssh\u002Fid_rsa.pub",[387,597,598],{"class":397}," username@remote_host\n",[316,600,601],{},[165,602,603],{},"将 username 换为远程服务器用户名，remote_host 换为服务器的 IP 或域名。期间需要输入一次远程服务器的登录密码。",[169,605,606],{},[172,607,608,611],{},[175,609,610],{},"方法 B："," 通过一条复合命令手动复制，如果不想安装新工具，直接在本地终端运行以下命令：",[377,613,615],{"className":379,"code":614,"language":381,"meta":382,"style":382},"cat ~\u002F.ssh\u002Fid_rsa.pub | ssh username@remote_host \"mkdir -p ~\u002F.ssh && chmod 700 ~\u002F.ssh && cat >> ~\u002F.ssh\u002Fauthorized_keys && chmod 600 ~\u002F.ssh\u002Fauthorized_keys\"\n",[384,616,617],{"__ignoreMap":382},[387,618,619,622,624,627,630,633,635,638],{"class":389,"line":390},[387,620,621],{"class":393},"cat",[387,623,595],{"class":397},[387,625,626],{"class":464}," |",[387,628,629],{"class":393}," ssh",[387,631,632],{"class":397}," username@remote_host",[387,634,465],{"class":464},[387,636,637],{"class":397},"mkdir -p ~\u002F.ssh && chmod 700 ~\u002F.ssh && cat >> ~\u002F.ssh\u002Fauthorized_keys && chmod 600 ~\u002F.ssh\u002Fauthorized_keys",[387,639,640],{"class":464},"\"\n",[345,642,644],{"id":643},"_312-公钥命名注意事项","3.1.2 公钥命名注意事项",[165,646,647],{},"默认情况下，OpenSSH 服务要求服务器端存储公钥的文件必须命名为 authorized_keys，不能随意更改。如需自定义文件名：",[169,649,650,653,656],{},[172,651,652],{},"用管理员权限打开 \u002Fetc\u002Fssh\u002Fsshd_config",[172,654,655],{},"找到AuthorizedKeysFile配置项，把它的值修改为你想要的自定义文件名，比如AuthorizedKeysFile .ssh\u002Fmy_custom_keys",[172,657,658],{},"保存配置后重启SSH服务（执行systemctl restart sshd），之后SSH服务就会自动读取你指定的自定义名称的公钥文件完成认证。",[660,661,662],"blockquote",{},[165,663,664],{},"📌 即使修改了文件名，文件仍需放在对应用户家目录的 .ssh 文件夹下，且必须严格遵守权限要求：.ssh 目录权限为 700，公钥文件权限为 600",[345,666,668],{"id":667},"_313-测试免密登录","3.1.3 测试免密登录",[165,670,671],{},"完成上述步骤后，在本地终端尝试连接远程服务器：",[377,673,675],{"className":379,"code":674,"language":381,"meta":382,"style":382},"ssh username@remote_host\n",[384,676,677],{"__ignoreMap":382},[387,678,679,682],{"class":389,"line":390},[387,680,681],{"class":393},"ssh",[387,683,598],{"class":397},[165,685,686],{},"如果无需输入密码直接进入服务器系统，则说明配置成功！",[329,688,690],{"id":689},"_32-tcp-明文方式","3.2 TCP 明文方式",[165,692,693],{},"TCP 明文远程连接指采用了非加密模式对外提供服务。Docker默认开启 TCP 2375 端口且不加 TLS 加密意味着‌任何能访问该端口的人都可以完全控制你的 Docker 守护进程‌（相当于拥有 root 权限），此方式所有数据（含敏感信息）明文传输，严禁用于生产环境或跨公网访问。",[695,696,697,703],"tip",{},[165,698,699,700],{},"注意:",[701,702],"br",{},[169,704,705,708,711],{},[172,706,707],{},"严禁‌在公网直接暴露未加密的 2375 端口。",[172,709,710],{},"生产环境务必使用 ‌TLS 证书认证‌ 或通过 ‌SSH 隧道‌ 进行连接。",[172,712,713],{},"如果仅在局域网测试，可以临时使用TCP 2375端口，但请确保防火墙限制了访问 IP，避免所有人都能访问。",[345,715,717],{"id":716},"_321-修改-docker-配置开启-tcp-监听","3.2.1 修改 Docker 配置，开启 TCP 监听",[165,719,720],{},"Docker 默认只监听 Unix Socket (\u002Fvar\u002Frun\u002Fdocker.sock)。要开启 TCP 远程连接，需修改启动参数。",[356,722,723],{},[172,724,725],{},[175,726,727],{},"方法一：修改 daemon.json (推荐)",[165,729,730],{},"这是官方推荐的配置方式，避免直接修改 systemd 服务文件导致升级冲突。",[169,732,733],{},[172,734,735],{},[175,736,737],{},"编辑或创建 \u002Fetc\u002Fdocker\u002Fdaemon.json 文件",[377,739,741],{"className":379,"code":740,"language":381,"meta":382,"style":382},"sudo vim \u002Fetc\u002Fdocker\u002Fdaemon.json\n",[384,742,743],{"__ignoreMap":382},[387,744,745,748,751],{"class":389,"line":390},[387,746,747],{"class":393},"sudo",[387,749,750],{"class":397}," vim",[387,752,753],{"class":397}," \u002Fetc\u002Fdocker\u002Fdaemon.json\n",[169,755,756],{},[172,757,758],{},[175,759,760],{},"添加以下内容，配置同时监听本地Unix socket和TCP端口",[377,762,766],{"className":763,"code":764,"language":765,"meta":382,"style":382},"language-json shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","{\n    \"hosts\": [\n        \"unix:\u002F\u002F\u002Fvar\u002Frun\u002Fdocker.sock\",\n        \"tcp:\u002F\u002F0.0.0.0:2375\"\n    ]\n}\n","json",[384,767,768,773,790,803,812,817],{"__ignoreMap":382},[387,769,770],{"class":389,"line":390},[387,771,772],{"class":464},"{\n",[387,774,775,778,782,784,787],{"class":389,"line":432},[387,776,777],{"class":464},"    \"",[387,779,781],{"class":780},"spNyl","hosts",[387,783,471],{"class":464},[387,785,786],{"class":464},":",[387,788,789],{"class":464}," [\n",[387,791,792,795,798,800],{"class":389,"line":444},[387,793,794],{"class":464},"        \"",[387,796,797],{"class":397},"unix:\u002F\u002F\u002Fvar\u002Frun\u002Fdocker.sock",[387,799,471],{"class":464},[387,801,802],{"class":464},",\n",[387,804,805,807,810],{"class":389,"line":451},[387,806,794],{"class":464},[387,808,809],{"class":397},"tcp:\u002F\u002F0.0.0.0:2375",[387,811,640],{"class":464},[387,813,814],{"class":389,"line":457},[387,815,816],{"class":464},"    ]\n",[387,818,819],{"class":389,"line":480},[387,820,821],{"class":464},"}\n",[316,823,824],{},[165,825,826],{},"注意：tcp:\u002F\u002F0.0.0.0:2375 表示监听所有网络接口。生产环境建议替换为特定IP（如内网IP）以限制访问范围。",[169,828,829],{},[172,830,831],{},[175,832,833],{},"重启Docker服务使配置生效",[377,835,837],{"className":379,"code":836,"language":381,"meta":382,"style":382},"sudo systemctl daemon-reload\nsudo systemctl restart docker\n",[384,838,839,849],{"__ignoreMap":382},[387,840,841,843,846],{"class":389,"line":390},[387,842,747],{"class":393},[387,844,845],{"class":397}," systemctl",[387,847,848],{"class":397}," daemon-reload\n",[387,850,851,853,855,858],{"class":389,"line":432},[387,852,747],{"class":393},[387,854,845],{"class":397},[387,856,857],{"class":397}," restart",[387,859,860],{"class":397}," docker\n",[356,862,863],{"start":432},[172,864,865],{},[175,866,867],{},"方法二：使用 systemd 覆盖文件",[165,869,870],{},"此方式只适用于使用systemd的Linux发行版。",[169,872,873],{},[172,874,875],{},[175,876,877],{},"创建systemd覆盖文件",[377,879,881],{"className":379,"code":880,"language":381,"meta":382,"style":382},"sudo systemctl edit docker.service\n",[384,882,883],{"__ignoreMap":382},[387,884,885,887,889,892],{"class":389,"line":390},[387,886,747],{"class":393},[387,888,845],{"class":397},[387,890,891],{"class":397}," edit",[387,893,894],{"class":397}," docker.service\n",[169,896,897],{},[172,898,899],{},[175,900,901],{},"添加以下内容：",[377,903,907],{"className":904,"code":905,"language":906,"meta":382,"style":382},"language-ini shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","[Service]\nExecStart=\nExecStart=\u002Fusr\u002Fbin\u002Fdockerd -H fd:\u002F\u002F -H tcp:\u002F\u002F0.0.0.0:2375\n","ini",[384,908,909,914,919],{"__ignoreMap":382},[387,910,911],{"class":389,"line":390},[387,912,913],{},"[Service]\n",[387,915,916],{"class":389,"line":432},[387,917,918],{},"ExecStart=\n",[387,920,921],{"class":389,"line":444},[387,922,923],{},"ExecStart=\u002Fusr\u002Fbin\u002Fdockerd -H fd:\u002F\u002F -H tcp:\u002F\u002F0.0.0.0:2375\n",[169,925,926],{},[172,927,928],{},[175,929,930],{},"重新加载并重启服务",[377,932,934],{"className":379,"code":933,"language":381,"meta":382,"style":382},"sudo systemctl daemon-reload\nsudo systemctl restart docker.service\n",[384,935,936,944],{"__ignoreMap":382},[387,937,938,940,942],{"class":389,"line":390},[387,939,747],{"class":393},[387,941,845],{"class":397},[387,943,848],{"class":397},[387,945,946,948,950,952],{"class":389,"line":432},[387,947,747],{"class":393},[387,949,845],{"class":397},[387,951,857],{"class":397},[387,953,894],{"class":397},[345,955,957],{"id":956},"_322-验证端口监听状态","3.2.2 验证端口监听状态",[165,959,960],{},"配置完成后，检查Docker是否正在监听目标端口。",[377,962,964],{"className":379,"code":963,"language":381,"meta":382,"style":382},"sudo netstat -lntp | grep dockerd\n",[384,965,966],{"__ignoreMap":382},[387,967,968,970,973,976,978,981],{"class":389,"line":390},[387,969,747],{"class":393},[387,971,972],{"class":397}," netstat",[387,974,975],{"class":397}," -lntp",[387,977,626],{"class":464},[387,979,980],{"class":393}," grep",[387,982,983],{"class":397}," dockerd\n",[165,985,986],{},"应能看到类似 tcp 0 0 0.0.0.0:2375 0.0.0.0:* LISTEN 的输出。",[345,988,990],{"id":989},"_323-开放防火墙端口","3.2.3 开放防火墙端口",[165,992,993],{},"如果服务器开启了防火墙，需要放行对应端口。",[169,995,996],{},[172,997,998],{},"如果虚拟机是 Ubuntu 系统：",[377,1000,1002],{"className":379,"code":1001,"language":381,"meta":382,"style":382},"sudo ufw allow 2375\u002Ftcp && sudo ufw reload\n",[384,1003,1004],{"__ignoreMap":382},[387,1005,1006,1008,1011,1014,1017,1020,1023,1025],{"class":389,"line":390},[387,1007,747],{"class":393},[387,1009,1010],{"class":397}," ufw",[387,1012,1013],{"class":397}," allow",[387,1015,1016],{"class":397}," 2375\u002Ftcp",[387,1018,1019],{"class":464}," &&",[387,1021,1022],{"class":393}," sudo",[387,1024,1010],{"class":397},[387,1026,1027],{"class":397}," reload\n",[169,1029,1030],{},[172,1031,1032],{},"如果虚拟机是 CentOS \u002F RedHat 系统：",[377,1034,1036],{"className":379,"code":1035,"language":381,"meta":382,"style":382},"sudo firewall-cmd --zone=public --add-port=2375\u002Ftcp --permanent && sudo firewall-cmd --reload\n",[384,1037,1038],{"__ignoreMap":382},[387,1039,1040,1042,1045,1048,1051,1054,1056,1058,1060],{"class":389,"line":390},[387,1041,747],{"class":393},[387,1043,1044],{"class":397}," firewall-cmd",[387,1046,1047],{"class":397}," --zone=public",[387,1049,1050],{"class":397}," --add-port=2375\u002Ftcp",[387,1052,1053],{"class":397}," --permanent",[387,1055,1019],{"class":464},[387,1057,1022],{"class":393},[387,1059,1044],{"class":397},[387,1061,1062],{"class":397}," --reload\n",[316,1064,1065],{},[165,1066,1067],{},"注意：如果使用云服务器（如 AWS、阿里云等），还需在云平台的安全组中放行 2375 端口。",[329,1069,1071],{"id":1070},"_33-tcp-tls-加密方式","3.3 TCP + TLS 加密方式",[165,1073,1074],{},"当必须使用 TCP 且需要保证安全性时（如跨公网访问），务必启用 TLS 加密。要实现 Docker 的 TCP SSL（通常称为 TLS）远程安全连接，需要经历生成证书、配置服务端、客户端连接三个主要步骤。",[345,1076,1078],{"id":1077},"_331-生成ca证书与密钥","3.3.1 生成CA证书与密钥",[165,1080,1081],{},"我们需要在 Docker 服务器上，使用OpenSSL工具为服务端和客户端生成自签名证书。",[356,1083,1084],{},[172,1085,1086,1089],{},[175,1087,1088],{},"创建工作目录："," 整个流程涉及大量命令，建议在操作前新建一个工作目录（如 \u002Fetc\u002Fdocker\u002Fcerts）来存放所有证书文件，方便管理。",[377,1091,1093],{"className":379,"code":1092,"language":381,"meta":382,"style":382},"mkdir -p \u002Fetc\u002Fdocker\u002Fcerts\ncd \u002Fetc\u002Fdocker\u002Fcerts\n",[384,1094,1095,1104],{"__ignoreMap":382},[387,1096,1097,1099,1101],{"class":389,"line":390},[387,1098,435],{"class":393},[387,1100,438],{"class":397},[387,1102,1103],{"class":397}," \u002Fetc\u002Fdocker\u002Fcerts\n",[387,1105,1106,1109],{"class":389,"line":432},[387,1107,1108],{"class":460},"cd",[387,1110,1103],{"class":397},[356,1112,1113],{"start":432},[172,1114,1115,1118],{},[175,1116,1117],{},"创建 CA 根证书RSA私钥："," 使用具有 AES-256 加密保护的 4096 位 RSA 算法，生成一个用于自建 CA 的高度安全私钥文件，此处需要两次输入密码，请务必记住该密码，在后面步骤会用到。",[377,1120,1122],{"className":379,"code":1121,"language":381,"meta":382,"style":382},"openssl genrsa -aes256 -out ca-key.pem 4096\n",[384,1123,1124],{"__ignoreMap":382},[387,1125,1126,1129,1132,1135,1138,1141],{"class":389,"line":390},[387,1127,1128],{"class":393},"openssl",[387,1130,1131],{"class":397}," genrsa",[387,1133,1134],{"class":397}," -aes256",[387,1136,1137],{"class":397}," -out",[387,1139,1140],{"class":397}," ca-key.pem",[387,1142,408],{"class":407},[356,1144,1145],{"start":444},[172,1146,1147,1150,1151,1154],{},[175,1148,1149],{},"创建 CA 根证书："," 这条新命令会用到你刚创建的",[384,1152,1153],{},"ca-key.pem","（需要输入你设定的密码），并生成一个有效期为 10 年（3650天）的根证书 ca-cert.pem。",[377,1156,1158],{"className":379,"code":1157,"language":381,"meta":382,"style":382},"openssl req -new -x509 -days 3650 -key ca-key.pem -out ca-cert.pem\n",[384,1159,1160],{"__ignoreMap":382},[387,1161,1162,1164,1167,1170,1173,1176,1179,1182,1184,1186],{"class":389,"line":390},[387,1163,1128],{"class":393},[387,1165,1166],{"class":397}," req",[387,1168,1169],{"class":397}," -new",[387,1171,1172],{"class":397}," -x509",[387,1174,1175],{"class":397}," -days",[387,1177,1178],{"class":407}," 3650",[387,1180,1181],{"class":397}," -key",[387,1183,1140],{"class":397},[387,1185,1137],{"class":397},[387,1187,1188],{"class":397}," ca-cert.pem\n",[356,1190,1191],{"start":451},[172,1192,1193,1196],{},[175,1194,1195],{},"创建服务端私钥："," 生成一个名为server-key.pem的服务端私钥",[377,1198,1200],{"className":379,"code":1199,"language":381,"meta":382,"style":382},"openssl genrsa -out server-key.pem 4096\n",[384,1201,1202],{"__ignoreMap":382},[387,1203,1204,1206,1208,1210,1213],{"class":389,"line":390},[387,1205,1128],{"class":393},[387,1207,1131],{"class":397},[387,1209,1137],{"class":397},[387,1211,1212],{"class":397}," server-key.pem",[387,1214,408],{"class":407},[356,1216,1217],{"start":457},[172,1218,1219,1222],{},[175,1220,1221],{},"创建服务端签名请求证书文件："," 生成服务端证书签名请求 (server.csr)，将 $HOST 替换为客户端用来连接服务器的域名或IP地址。",[377,1224,1226],{"className":379,"code":1225,"language":381,"meta":382,"style":382},"openssl req -subj \"\u002FCN=192.168.1.7\" -sha256 -new -key server-key.pem -out server.csr\n",[384,1227,1228],{"__ignoreMap":382},[387,1229,1230,1232,1234,1237,1239,1242,1244,1247,1249,1251,1253,1255],{"class":389,"line":390},[387,1231,1128],{"class":393},[387,1233,1166],{"class":397},[387,1235,1236],{"class":397}," -subj",[387,1238,465],{"class":464},[387,1240,1241],{"class":397},"\u002FCN=192.168.1.7",[387,1243,471],{"class":464},[387,1245,1246],{"class":397}," -sha256",[387,1248,1169],{"class":397},[387,1250,1181],{"class":397},[387,1252,1212],{"class":397},[387,1254,1137],{"class":397},[387,1256,1257],{"class":397}," server.csr\n",[356,1259,1260],{"start":480},[172,1261,1262,1265],{},[175,1263,1264],{},"创建extfile.cnf的配置文件："," 签署时，必须通过配置文件确保Subject Alternative Name (SAN)中包含服务器的所有访问地址。否则，客户端连接会因主机名不匹配而失败。其中IP地址改为自己服务器IP地址。",[377,1267,1269],{"className":379,"code":1268,"language":381,"meta":382,"style":382},"echo subjectAltName = IP:192.168.1.7,IP:127.0.0.1 >> extfile.cnf\necho extendedKeyUsage = serverAuth >> extfile.cnf\n",[384,1270,1271,1289],{"__ignoreMap":382},[387,1272,1273,1275,1278,1281,1284,1286],{"class":389,"line":390},[387,1274,461],{"class":460},[387,1276,1277],{"class":397}," subjectAltName",[387,1279,1280],{"class":397}," =",[387,1282,1283],{"class":397}," IP:192.168.1.7,IP:127.0.0.1",[387,1285,474],{"class":464},[387,1287,1288],{"class":397}," extfile.cnf\n",[387,1290,1291,1293,1296,1298,1301,1303],{"class":389,"line":432},[387,1292,461],{"class":460},[387,1294,1295],{"class":397}," extendedKeyUsage",[387,1297,1280],{"class":397},[387,1299,1300],{"class":397}," serverAuth",[387,1302,474],{"class":464},[387,1304,1288],{"class":397},[356,1306,1307],{"start":485},[172,1308,1309,1312],{},[175,1310,1311],{},"创建签名生效的服务端证书文件："," 这一步会生成最终的服务端证书 server-cert.pem。",[377,1314,1316],{"className":379,"code":1315,"language":381,"meta":382,"style":382},"openssl x509 -req -days 3650 -sha256 -in server.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out server-cert.pem -extfile extfile.cnf\n",[384,1317,1318],{"__ignoreMap":382},[387,1319,1320,1322,1325,1328,1330,1332,1334,1337,1340,1343,1346,1349,1351,1354,1356,1359,1362],{"class":389,"line":390},[387,1321,1128],{"class":393},[387,1323,1324],{"class":397}," x509",[387,1326,1327],{"class":397}," -req",[387,1329,1175],{"class":397},[387,1331,1178],{"class":407},[387,1333,1246],{"class":397},[387,1335,1336],{"class":397}," -in",[387,1338,1339],{"class":397}," server.csr",[387,1341,1342],{"class":397}," -CA",[387,1344,1345],{"class":397}," ca.pem",[387,1347,1348],{"class":397}," -CAkey",[387,1350,1140],{"class":397},[387,1352,1353],{"class":397}," -CAcreateserial",[387,1355,1137],{"class":397},[387,1357,1358],{"class":397}," server-cert.pem",[387,1360,1361],{"class":397}," -extfile",[387,1363,1288],{"class":397},[356,1365,1366],{"start":491},[172,1367,1368],{},[175,1369,1370],{},"创建客户端私钥",[377,1372,1374],{"className":379,"code":1373,"language":381,"meta":382,"style":382},"openssl genrsa -out key.pem 4096\n",[384,1375,1376],{"__ignoreMap":382},[387,1377,1378,1380,1382,1384,1387],{"class":389,"line":390},[387,1379,1128],{"class":393},[387,1381,1131],{"class":397},[387,1383,1137],{"class":397},[387,1385,1386],{"class":397}," key.pem",[387,1388,408],{"class":407},[356,1390,1391],{"start":502},[172,1392,1393],{},[175,1394,1395],{},"创建客户端签名请求证书文件",[377,1397,1399],{"className":379,"code":1398,"language":381,"meta":382,"style":382},"openssl req -subj '\u002FCN=client' -new -key key.pem -out client.csr\n",[384,1400,1401],{"__ignoreMap":382},[387,1402,1403,1405,1407,1409,1412,1415,1418,1420,1422,1424,1426],{"class":389,"line":390},[387,1404,1128],{"class":393},[387,1406,1166],{"class":397},[387,1408,1236],{"class":397},[387,1410,1411],{"class":464}," '",[387,1413,1414],{"class":397},"\u002FCN=client",[387,1416,1417],{"class":464},"'",[387,1419,1169],{"class":397},[387,1421,1181],{"class":397},[387,1423,1386],{"class":397},[387,1425,1137],{"class":397},[387,1427,1428],{"class":397}," client.csr\n",[356,1430,1431],{"start":512},[172,1432,1433],{},[175,1434,1435],{},"extfile.cnf文件中增加配置",[377,1437,1439],{"className":379,"code":1438,"language":381,"meta":382,"style":382},"echo extendedKeyUsage = clientAuth >> extfile.cnf\n",[384,1440,1441],{"__ignoreMap":382},[387,1442,1443,1445,1447,1449,1452,1454],{"class":389,"line":390},[387,1444,461],{"class":460},[387,1446,1295],{"class":397},[387,1448,1280],{"class":397},[387,1450,1451],{"class":397}," clientAuth",[387,1453,474],{"class":464},[387,1455,1288],{"class":397},[356,1457,1458],{"start":517},[172,1459,1460],{},[175,1461,1462],{},"创建签名生效的客户端证书文件",[377,1464,1466],{"className":379,"code":1465,"language":381,"meta":382,"style":382},"openssl x509 -req -days 3650 -sha256 -in client.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out cert.pem -extfile extfile.cnf\n",[384,1467,1468],{"__ignoreMap":382},[387,1469,1470,1472,1474,1476,1478,1480,1482,1484,1487,1489,1491,1493,1495,1497,1499,1502,1504],{"class":389,"line":390},[387,1471,1128],{"class":393},[387,1473,1324],{"class":397},[387,1475,1327],{"class":397},[387,1477,1175],{"class":397},[387,1479,1178],{"class":407},[387,1481,1246],{"class":397},[387,1483,1336],{"class":397},[387,1485,1486],{"class":397}," client.csr",[387,1488,1342],{"class":397},[387,1490,1345],{"class":397},[387,1492,1348],{"class":397},[387,1494,1140],{"class":397},[387,1496,1353],{"class":397},[387,1498,1137],{"class":397},[387,1500,1501],{"class":397}," cert.pem",[387,1503,1361],{"class":397},[387,1505,1288],{"class":397},[356,1507,1508],{"start":523},[172,1509,1510],{},[175,1511,1512],{},"清理临时文件",[377,1514,1516],{"className":379,"code":1515,"language":381,"meta":382,"style":382},"rm -v client.csr server.csr extfile.cnf\n",[384,1517,1518],{"__ignoreMap":382},[387,1519,1520,1523,1526,1528,1530],{"class":389,"line":390},[387,1521,1522],{"class":393},"rm",[387,1524,1525],{"class":397}," -v",[387,1527,1486],{"class":397},[387,1529,1339],{"class":397},[387,1531,1288],{"class":397},[356,1533,1535],{"start":1534},13,[172,1536,1537],{},[175,1538,1539],{},"为证书文件授权",[377,1541,1543],{"className":379,"code":1542,"language":381,"meta":382,"style":382},"chmod -v 0400 ca-key.pem key.pem server-key.pem\nchmod -v 0444 ca.pem server-cert.pem cert.pem\n",[384,1544,1545,1561],{"__ignoreMap":382},[387,1546,1547,1549,1551,1554,1556,1558],{"class":389,"line":390},[387,1548,494],{"class":393},[387,1550,1525],{"class":397},[387,1552,1553],{"class":407}," 0400",[387,1555,1140],{"class":397},[387,1557,1386],{"class":397},[387,1559,1560],{"class":397}," server-key.pem\n",[387,1562,1563,1565,1567,1570,1572,1574],{"class":389,"line":432},[387,1564,494],{"class":393},[387,1566,1525],{"class":397},[387,1568,1569],{"class":407}," 0444",[387,1571,1345],{"class":397},[387,1573,1358],{"class":397},[387,1575,1576],{"class":397}," cert.pem\n",[356,1578,1580],{"start":1579},14,[172,1581,1582],{},[175,1583,1584],{},"查看证书有效期",[377,1586,1588],{"className":379,"code":1587,"language":381,"meta":382,"style":382},"[root@localhost certs]# openssl x509 -in ca.pem -noout -dates\nnotBefore=Aug 18 09:35:45 2026 GMT\nnotAfter=Aug 15 09:35:45 2036 GMT\n",[384,1589,1590,1605,1628],{"__ignoreMap":382},[387,1591,1592,1595,1599,1602],{"class":389,"line":390},[387,1593,1594],{"class":464},"[",[387,1596,1598],{"class":1597},"sTEyZ","root@localhost certs",[387,1600,1601],{"class":464},"]",[387,1603,1604],{"class":1597},"# openssl x509 -in ca.pem -noout -dates\n",[387,1606,1607,1610,1613,1616,1619,1622,1625],{"class":389,"line":432},[387,1608,1609],{"class":1597},"notBefore",[387,1611,1612],{"class":464},"=",[387,1614,1615],{"class":397},"Aug",[387,1617,1618],{"class":393}," 18",[387,1620,1621],{"class":397}," 09:35:45",[387,1623,1624],{"class":407}," 2026",[387,1626,1627],{"class":397}," GMT\n",[387,1629,1630,1633,1635,1637,1640,1642,1645],{"class":389,"line":444},[387,1631,1632],{"class":1597},"notAfter",[387,1634,1612],{"class":464},[387,1636,1615],{"class":397},[387,1638,1639],{"class":393}," 15",[387,1641,1621],{"class":397},[387,1643,1644],{"class":407}," 2036",[387,1646,1627],{"class":397},[345,1648,1650],{"id":1649},"_332-配置-docker-服务启用-tls","3.3.2 配置 Docker 服务启用 TLS",[165,1652,1653,1654,1657],{},"假设您已经在",[384,1655,1656],{},"\u002Fetc\u002Fdocker\u002Fcerts\u002F"," 目录下生成好了服务端证书文件，现在需要在服务端配置ssl证书位置，让Docker支持TLS连接。服务端需要配置的证书如下：",[169,1659,1660,1663,1666],{},[172,1661,1662],{},"ca.pem（CA 公钥）",[172,1664,1665],{},"server-cert.pem（服务器公钥）",[172,1667,1668],{},"server-key.pem（服务器私钥）",[356,1670,1671],{},[172,1672,1673,1676],{},[175,1674,1675],{},"修改 Docker 配置文件："," 打开或创建 Docker 的 daemon 配置文件：",[377,1678,1680],{"className":379,"code":1679,"language":381,"meta":382,"style":382},"sudo vi \u002Fetc\u002Fdocker\u002Fdaemon.json\n",[384,1681,1682],{"__ignoreMap":382},[387,1683,1684,1686,1689],{"class":389,"line":390},[387,1685,747],{"class":393},[387,1687,1688],{"class":397}," vi",[387,1690,753],{"class":397},[165,1692,1693],{},"把里面的内容修改或添加为：",[377,1695,1697],{"className":763,"code":1696,"language":765,"meta":382,"style":382},"{\n    \"hosts\": [\"unix:\u002F\u002F\u002Fvar\u002Frun\u002Fdocker.sock\", \"tcp:\u002F\u002F0.0.0.0:2376\"],\n    \"tls\": true,\n    \"tlsverify\": true,\n    \"tlscacert\": \"\u002Fetc\u002Fdocker\u002Fcerts\u002Fca.pem\",\n    \"tlscert\": \"\u002Fetc\u002Fdocker\u002Fcerts\u002Fserver-cert.pem\",\n    \"tlskey\": \"\u002Fetc\u002Fdocker\u002Fcerts\u002Fserver-key.pem\"\n}\n",[384,1698,1699,1703,1735,1749,1762,1782,1802,1820],{"__ignoreMap":382},[387,1700,1701],{"class":389,"line":390},[387,1702,772],{"class":464},[387,1704,1705,1707,1709,1711,1713,1716,1718,1720,1722,1725,1727,1730,1732],{"class":389,"line":432},[387,1706,777],{"class":464},[387,1708,781],{"class":780},[387,1710,471],{"class":464},[387,1712,786],{"class":464},[387,1714,1715],{"class":464}," [",[387,1717,471],{"class":464},[387,1719,797],{"class":397},[387,1721,471],{"class":464},[387,1723,1724],{"class":464},",",[387,1726,465],{"class":464},[387,1728,1729],{"class":397},"tcp:\u002F\u002F0.0.0.0:2376",[387,1731,471],{"class":464},[387,1733,1734],{"class":464},"],\n",[387,1736,1737,1739,1742,1744,1746],{"class":389,"line":444},[387,1738,777],{"class":464},[387,1740,1741],{"class":780},"tls",[387,1743,471],{"class":464},[387,1745,786],{"class":464},[387,1747,1748],{"class":464}," true,\n",[387,1750,1751,1753,1756,1758,1760],{"class":389,"line":451},[387,1752,777],{"class":464},[387,1754,1755],{"class":780},"tlsverify",[387,1757,471],{"class":464},[387,1759,786],{"class":464},[387,1761,1748],{"class":464},[387,1763,1764,1766,1769,1771,1773,1775,1778,1780],{"class":389,"line":457},[387,1765,777],{"class":464},[387,1767,1768],{"class":780},"tlscacert",[387,1770,471],{"class":464},[387,1772,786],{"class":464},[387,1774,465],{"class":464},[387,1776,1777],{"class":397},"\u002Fetc\u002Fdocker\u002Fcerts\u002Fca.pem",[387,1779,471],{"class":464},[387,1781,802],{"class":464},[387,1783,1784,1786,1789,1791,1793,1795,1798,1800],{"class":389,"line":480},[387,1785,777],{"class":464},[387,1787,1788],{"class":780},"tlscert",[387,1790,471],{"class":464},[387,1792,786],{"class":464},[387,1794,465],{"class":464},[387,1796,1797],{"class":397},"\u002Fetc\u002Fdocker\u002Fcerts\u002Fserver-cert.pem",[387,1799,471],{"class":464},[387,1801,802],{"class":464},[387,1803,1804,1806,1809,1811,1813,1815,1818],{"class":389,"line":485},[387,1805,777],{"class":464},[387,1807,1808],{"class":780},"tlskey",[387,1810,471],{"class":464},[387,1812,786],{"class":464},[387,1814,465],{"class":464},[387,1816,1817],{"class":397},"\u002Fetc\u002Fdocker\u002Fcerts\u002Fserver-key.pem",[387,1819,640],{"class":464},[387,1821,1822],{"class":389,"line":491},[387,1823,821],{"class":464},[695,1825,1826,1831],{},[165,1827,1828,1829],{},"温馨提示：",[701,1830],{},[169,1832,1833,1836,1839],{},[172,1834,1835],{},"hosts: 监听本地Unix Socket和所有网络接口的2376端口（TLS加密端口）。",[172,1837,1838],{},"tls & tlsverify: 开启TLS并进行客户端证书验证。",[172,1840,1841],{},"后面的三个参数分别指定了CA证书、服务端证书和服务端私钥的路径。",[356,1843,1844],{"start":432},[172,1845,1846],{},[175,1847,1848],{},"修改 Systemd 启动服务",[165,1850,1851],{},"在现代 Linux 系统中，Systemd 的默认启动命令会和 daemon.json 中的 hosts 冲突。我们需要做个小修改：",[377,1853,1854],{"className":379,"code":880,"language":381,"meta":382,"style":382},[384,1855,1856],{"__ignoreMap":382},[387,1857,1858,1860,1862,1864],{"class":389,"line":390},[387,1859,747],{"class":393},[387,1861,845],{"class":397},[387,1863,891],{"class":397},[387,1865,894],{"class":397},[165,1867,1868],{},"在打开的空文件中，输入以下内容并保存：",[377,1870,1872],{"className":379,"code":1871,"language":381,"meta":382,"style":382},"[Service]\nExecStart=\nExecStart=\u002Fusr\u002Fbin\u002Fdockerd\n",[384,1873,1874,1884,1892],{"__ignoreMap":382},[387,1875,1876,1878,1881],{"class":389,"line":390},[387,1877,1594],{"class":464},[387,1879,1880],{"class":1597},"Service",[387,1882,1883],{"class":464},"]\n",[387,1885,1886,1889],{"class":389,"line":432},[387,1887,1888],{"class":1597},"ExecStart",[387,1890,1891],{"class":464},"=\n",[387,1893,1894,1896,1898],{"class":389,"line":444},[387,1895,1888],{"class":1597},[387,1897,1612],{"class":464},[387,1899,1900],{"class":397},"\u002Fusr\u002Fbin\u002Fdockerd\n",[316,1902,1903],{},[165,1904,1905],{},"注：第一行留空是为了清除系统默认的启动参数，第二行使用干净的命令启动，这样 Docker 就会完全听从 daemon.json 的配置。",[356,1907,1908],{"start":444},[172,1909,1910],{},[175,1911,1912],{},"重启 Docker 服务",[377,1914,1915],{"className":379,"code":836,"language":381,"meta":382,"style":382},[384,1916,1917,1925],{"__ignoreMap":382},[387,1918,1919,1921,1923],{"class":389,"line":390},[387,1920,747],{"class":393},[387,1922,845],{"class":397},[387,1924,848],{"class":397},[387,1926,1927,1929,1931,1933],{"class":389,"line":432},[387,1928,747],{"class":393},[387,1930,845],{"class":397},[387,1932,857],{"class":397},[387,1934,860],{"class":397},[356,1936,1937],{"start":451},[172,1938,1939,1942],{},[175,1940,1941],{},"开放防火墙端口："," 确保您的服务器放行了 2376 端口。",[377,1944,1946],{"className":379,"code":1945,"language":381,"meta":382,"style":382},"firewall-cmd --zone=public --add-port=2376\u002Ftcp --permanent\nfirewall-cmd --reload\n",[384,1947,1948,1961],{"__ignoreMap":382},[387,1949,1950,1953,1955,1958],{"class":389,"line":390},[387,1951,1952],{"class":393},"firewall-cmd",[387,1954,1047],{"class":397},[387,1956,1957],{"class":397}," --add-port=2376\u002Ftcp",[387,1959,1960],{"class":397}," --permanent\n",[387,1962,1963,1965],{"class":389,"line":432},[387,1964,1952],{"class":393},[387,1966,1062],{"class":397},[195,1968,1970],{"id":1969},"_4-本地终端连接远程-docker","4 本地终端连接远程 Docker",[165,1972,1973],{},"服务端配置完成后，回到本地终端，进行客户端侧的配置。",[329,1975,1977],{"id":1976},"_41-ssh-隧道方式","4.1 SSH 隧道方式",[356,1979,1980],{},[172,1981,1982,1985],{},[175,1983,1984],{},"临时连接："," 单次使用时，可以采用临时连接的方式。",[377,1987,1989],{"className":379,"code":1988,"language":381,"meta":382,"style":382},"docker -H ssh:\u002F\u002F\u003C用户名>@\u003C远程IP> ps\n",[384,1990,1991],{"__ignoreMap":382},[387,1992,1993,1996,1999,2002,2005,2008,2011,2014,2017,2019,2022,2025,2027],{"class":389,"line":390},[387,1994,1995],{"class":393},"docker",[387,1997,1998],{"class":397}," -H",[387,2000,2001],{"class":397}," ssh:\u002F\u002F",[387,2003,2004],{"class":464},"\u003C",[387,2006,2007],{"class":397},"用户",[387,2009,2010],{"class":1597},"名",[387,2012,2013],{"class":464},">",[387,2015,2016],{"class":397},"@",[387,2018,2004],{"class":464},[387,2020,2021],{"class":397},"远程I",[387,2023,2024],{"class":1597},"P",[387,2026,2013],{"class":464},[387,2028,2029],{"class":397}," ps\n",[165,2031,2032],{},"示例：docker -H ssh:\u002F\u002Froot@192.168.1.7 ps",[356,2034,2035],{"start":432},[172,2036,2037,2040],{},[175,2038,2039],{},"持久化配置："," 推荐使用Docker Context进行管理。",[169,2042,2043],{},[172,2044,2045],{},"直接使用下面命令创建一个名为ssh-docker，并且通过ssh连接远程docker端点的Docker Context。",[377,2047,2049],{"className":379,"code":2048,"language":381,"meta":382,"style":382},"docker context create ssh-docker --docker \"host=ssh:\u002F\u002Fanyfork@192.168.1.7\"\n",[384,2050,2051],{"__ignoreMap":382},[387,2052,2053,2055,2058,2061,2064,2067,2069,2072],{"class":389,"line":390},[387,2054,1995],{"class":393},[387,2056,2057],{"class":397}," context",[387,2059,2060],{"class":397}," create",[387,2062,2063],{"class":397}," ssh-docker",[387,2065,2066],{"class":397}," --docker",[387,2068,465],{"class":464},[387,2070,2071],{"class":397},"host=ssh:\u002F\u002Fanyfork@192.168.1.7",[387,2073,640],{"class":464},[169,2075,2076],{},[172,2077,2078],{},"切换到该 Context",[377,2080,2082],{"className":379,"code":2081,"language":381,"meta":382,"style":382},"docker context use ssh-docker\n",[384,2083,2084],{"__ignoreMap":382},[387,2085,2086,2088,2090,2093],{"class":389,"line":390},[387,2087,1995],{"class":393},[387,2089,2057],{"class":397},[387,2091,2092],{"class":397}," use",[387,2094,2095],{"class":397}," ssh-docker\n",[169,2097,2098],{},[172,2099,2100],{},"验证连接",[377,2102,2104],{"className":379,"code":2103,"language":381,"meta":382,"style":382},"docker info\n",[384,2105,2106],{"__ignoreMap":382},[387,2107,2108,2110],{"class":389,"line":390},[387,2109,1995],{"class":393},[387,2111,2112],{"class":397}," info\n",[169,2114,2115],{},[172,2116,2117],{},"指定自定义私钥：如果私钥未存放在默认位置或者自定义命名，可以指定路径。",[377,2119,2121],{"className":379,"code":2120,"language":381,"meta":382,"style":382},"docker context create ssh-docker  --docker \"host=ssh:\u002F\u002Froot@192.168.1.7?identity_file=~\u002F.ssh\u002Fcustom_key\"\n",[384,2122,2123],{"__ignoreMap":382},[387,2124,2125,2127,2129,2131,2133,2136,2138,2141],{"class":389,"line":390},[387,2126,1995],{"class":393},[387,2128,2057],{"class":397},[387,2130,2060],{"class":397},[387,2132,2063],{"class":397},[387,2134,2135],{"class":397},"  --docker",[387,2137,465],{"class":464},[387,2139,2140],{"class":397},"host=ssh:\u002F\u002Froot@192.168.1.7?identity_file=~\u002F.ssh\u002Fcustom_key",[387,2142,640],{"class":464},[169,2144,2145],{},[172,2146,2147],{},"切回本地",[377,2149,2151],{"className":379,"code":2150,"language":381,"meta":382,"style":382},"docker context use default\n",[384,2152,2153],{"__ignoreMap":382},[387,2154,2155,2157,2159,2161],{"class":389,"line":390},[387,2156,1995],{"class":393},[387,2158,2057],{"class":397},[387,2160,2092],{"class":397},[387,2162,2163],{"class":397}," default\n",[329,2165,2167],{"id":2166},"_42-tcp-明文方式","4.2 TCP 明文方式",[356,2169,2170],{},[172,2171,2172,1985],{},[175,2173,1984],{},[377,2175,2177],{"className":379,"code":2176,"language":381,"meta":382,"style":382},"docker -H tcp:\u002F\u002F\u003C远程IP>ps \n",[384,2178,2179],{"__ignoreMap":382},[387,2180,2181,2183,2185,2188,2190,2192,2194,2196],{"class":389,"line":390},[387,2182,1995],{"class":393},[387,2184,1998],{"class":397},[387,2186,2187],{"class":397}," tcp:\u002F\u002F",[387,2189,2004],{"class":464},[387,2191,2021],{"class":397},[387,2193,2024],{"class":1597},[387,2195,2013],{"class":464},[387,2197,2198],{"class":397},"ps\n",[165,2200,2201],{},"示例：docker -H tcp:\u002F\u002F192.168.1.7:2375 ps",[356,2203,2204],{"start":432},[172,2205,2206,2040],{},[175,2207,2039],{},[169,2209,2210],{},[172,2211,2212],{},"直接使用下面命令创建一个名为tcp-docker，并且通过tcp连接远程docker端点的Docker Context。",[377,2214,2216],{"className":379,"code":2215,"language":381,"meta":382,"style":382},"docker context create tcp-docker  --description \"虚拟机远程Docker-TCP\" --docker \"host=tcp:\u002F\u002F192.168.1.7:2375\"\n",[384,2217,2218],{"__ignoreMap":382},[387,2219,2220,2222,2224,2226,2229,2232,2234,2237,2239,2241,2243,2246],{"class":389,"line":390},[387,2221,1995],{"class":393},[387,2223,2057],{"class":397},[387,2225,2060],{"class":397},[387,2227,2228],{"class":397}," tcp-docker",[387,2230,2231],{"class":397},"  --description",[387,2233,465],{"class":464},[387,2235,2236],{"class":397},"虚拟机远程Docker-TCP",[387,2238,471],{"class":464},[387,2240,2066],{"class":397},[387,2242,465],{"class":464},[387,2244,2245],{"class":397},"host=tcp:\u002F\u002F192.168.1.7:2375",[387,2247,640],{"class":464},[169,2249,2250],{},[172,2251,2078],{},[377,2253,2255],{"className":379,"code":2254,"language":381,"meta":382,"style":382},"docker context use tcp-docker \n",[384,2256,2257],{"__ignoreMap":382},[387,2258,2259,2261,2263,2265],{"class":389,"line":390},[387,2260,1995],{"class":393},[387,2262,2057],{"class":397},[387,2264,2092],{"class":397},[387,2266,2267],{"class":397}," tcp-docker\n",[169,2269,2270],{},[172,2271,2100],{},[377,2273,2274],{"className":379,"code":2103,"language":381,"meta":382,"style":382},[384,2275,2276],{"__ignoreMap":382},[387,2277,2278,2280],{"class":389,"line":390},[387,2279,1995],{"class":393},[387,2281,2112],{"class":397},[169,2283,2284],{},[172,2285,2147],{},[377,2287,2288],{"className":379,"code":2150,"language":381,"meta":382,"style":382},[384,2289,2290],{"__ignoreMap":382},[387,2291,2292,2294,2296,2298],{"class":389,"line":390},[387,2293,1995],{"class":393},[387,2295,2057],{"class":397},[387,2297,2092],{"class":397},[387,2299,2163],{"class":397},[329,2301,2303],{"id":2302},"_43-tcp-tls-加密方式","4.3 TCP + TLS 加密方式",[165,2305,2306],{},"在客户端（您的本地电脑）上，您需要用到之前在服务器生成的这 3 个文件：ca.pem、cert.pem（客户端公钥）、key.pem（客户端私钥）。",[356,2308,2309],{},[172,2310,2311,2314],{},[175,2312,2313],{},"放置证书文件："," 建议在本地用户的家目录下创建一个安全文件夹，把这 3 个文件传到本地：",[169,2316,2317,2320],{},[172,2318,2319],{},"Linux \u002F macOS: 建议放在 ~\u002F.docker\u002F",[172,2321,2322],{},"Windows: 建议放在 C:\\Users\\您的用户名.docker\\certs",[356,2324,2325],{"start":432},[172,2326,2327,2330],{},[175,2328,2329],{},"临时测试连接："," 使用命令行直接带上参数，测试是否能连上服务器（请将 服务器IP 换成真实的）：",[377,2332,2334],{"className":379,"code":2333,"language":381,"meta":382,"style":382},"docker -H tcp:\u002F\u002F192.168.1.7:2376 --tlsverify --tlscacert=C:\u002FUsers\u002FAdministrator\u002F.docker\u002Fcerts\u002Fca.pem --tlscert=C:\u002FUsers\u002FAdministrator\u002F.docker\u002Fcerts\u002Fcert.pem --tlskey=C:\u002FUsers\u002FAdministrator\u002F.docker\u002Fcerts\u002Fkey.pem version\n",[384,2335,2336],{"__ignoreMap":382},[387,2337,2338,2340,2342,2345,2348,2351,2354,2357],{"class":389,"line":390},[387,2339,1995],{"class":393},[387,2341,1998],{"class":397},[387,2343,2344],{"class":397}," tcp:\u002F\u002F192.168.1.7:2376",[387,2346,2347],{"class":397}," --tlsverify",[387,2349,2350],{"class":397}," --tlscacert=C:\u002FUsers\u002FAdministrator\u002F.docker\u002Fcerts\u002Fca.pem",[387,2352,2353],{"class":397}," --tlscert=C:\u002FUsers\u002FAdministrator\u002F.docker\u002Fcerts\u002Fcert.pem",[387,2355,2356],{"class":397}," --tlskey=C:\u002FUsers\u002FAdministrator\u002F.docker\u002Fcerts\u002Fkey.pem",[387,2358,2359],{"class":397}," version\n",[165,2361,2362],{},"如果能正确打印出服务器的 Docker 版本信息，说明配置大功告成！",[356,2364,2365],{"start":444},[172,2366,2367,2370],{},[175,2368,2369],{},"配置环境变量："," 如果您不想每次都输入一长串参数，可以通过配置环境变量，让本地的 docker 命令默认走加密远程连接。",[169,2372,2373,2423],{},[172,2374,2375,2376,2379,2380],{},"Linux \u002F macOS (~\u002F.bashrc 或 ~\u002F.zshrc): 保存后记得执行",[384,2377,2378],{},"source ~\u002F.bashrc"," 生效。\n",[377,2381,2383],{"className":379,"code":2382,"language":381,"meta":382,"style":382},"export DOCKER_HOST=tcp:\u002F\u002F服务器IP:2376\nexport DOCKER_TLS_VERIFY=1\nexport DOCKER_CERT_PATH=~\u002F.docker\u002Fcerts\u002F\n",[384,2384,2385,2398,2410],{"__ignoreMap":382},[387,2386,2387,2390,2393,2395],{"class":389,"line":390},[387,2388,2389],{"class":780},"export",[387,2391,2392],{"class":1597}," DOCKER_HOST",[387,2394,1612],{"class":464},[387,2396,2397],{"class":1597},"tcp:\u002F\u002F服务器IP:2376\n",[387,2399,2400,2402,2405,2407],{"class":389,"line":432},[387,2401,2389],{"class":780},[387,2403,2404],{"class":1597}," DOCKER_TLS_VERIFY",[387,2406,1612],{"class":464},[387,2408,2409],{"class":407},"1\n",[387,2411,2412,2414,2417,2420],{"class":389,"line":444},[387,2413,2389],{"class":780},[387,2415,2416],{"class":1597}," DOCKER_CERT_PATH",[387,2418,2419],{"class":464},"=~",[387,2421,2422],{"class":1597},"\u002F.docker\u002Fcerts\u002F\n",[172,2424,2425,2426,2531],{},"Windows (PowerShell): 重新打开一个 PowerShell 窗口即可生效。\n",[377,2427,2429],{"className":379,"code":2428,"language":381,"meta":382,"style":382},"[Environment]::SetEnvironmentVariable(\"DOCKER_HOST\", \"tcp:\u002F\u002F服务器IP:2376\", \"User\")\n[Environment]::SetEnvironmentVariable(\"DOCKER_TLS_VERIFY\", \"1\", \"User\")\n[Environment]::SetEnvironmentVariable(\"DOCKER_CERT_PATH\", \"C:\u002FUsers\u002FAdministrator\u002F.docker\u002Fcerts\", \"User\")\n",[384,2430,2431,2467,2499],{"__ignoreMap":382},[387,2432,2433,2435,2438,2440,2443,2446,2448,2450,2453,2455,2457,2459,2462,2464],{"class":389,"line":390},[387,2434,1594],{"class":464},[387,2436,2437],{"class":1597},"Environment",[387,2439,1601],{"class":464},[387,2441,2442],{"class":1597},"::SetEnvironmentVariable(",[387,2444,2445],{"class":393},"\"DOCKER_HOST\"",[387,2447,1724],{"class":393},[387,2449,465],{"class":464},[387,2451,2452],{"class":397},"tcp:\u002F\u002F服务器IP:2376",[387,2454,471],{"class":464},[387,2456,1724],{"class":397},[387,2458,465],{"class":464},[387,2460,2461],{"class":397},"User",[387,2463,471],{"class":464},[387,2465,2466],{"class":1597},")\n",[387,2468,2469,2471,2473,2475,2477,2480,2482,2484,2487,2489,2491,2493,2495,2497],{"class":389,"line":432},[387,2470,1594],{"class":464},[387,2472,2437],{"class":1597},[387,2474,1601],{"class":464},[387,2476,2442],{"class":1597},[387,2478,2479],{"class":393},"\"DOCKER_TLS_VERIFY\"",[387,2481,1724],{"class":393},[387,2483,465],{"class":464},[387,2485,2486],{"class":397},"1",[387,2488,471],{"class":464},[387,2490,1724],{"class":397},[387,2492,465],{"class":464},[387,2494,2461],{"class":397},[387,2496,471],{"class":464},[387,2498,2466],{"class":1597},[387,2500,2501,2503,2505,2507,2509,2512,2514,2516,2519,2521,2523,2525,2527,2529],{"class":389,"line":444},[387,2502,1594],{"class":464},[387,2504,2437],{"class":1597},[387,2506,1601],{"class":464},[387,2508,2442],{"class":1597},[387,2510,2511],{"class":393},"\"DOCKER_CERT_PATH\"",[387,2513,1724],{"class":393},[387,2515,465],{"class":464},[387,2517,2518],{"class":397},"C:\u002FUsers\u002FAdministrator\u002F.docker\u002Fcerts",[387,2520,471],{"class":464},[387,2522,1724],{"class":397},[387,2524,465],{"class":464},[387,2526,2461],{"class":397},[387,2528,471],{"class":464},[387,2530,2466],{"class":1597},[316,2532,2533,2538],{},[165,2534,2535,2536],{},"只要您在 DOCKER_CERT_PATH 中指向了文件夹的路径（比如 C:\u002FUsers\u002FAdministrator\u002F.docker\u002Fcerts），Docker 客户端在连接时，就会自动去该文件夹下寻找固定命名的三个证书文件：",[701,2537],{},[169,2539,2540,2543,2546],{},[172,2541,2542],{},"ca.pem（CA 证书）",[172,2544,2545],{},"cert.pem（客户端证书）",[172,2547,2548],{},"key.pem（客户端私钥）",[356,2550,2551],{"start":451},[172,2552,2553,2556],{},[175,2554,2555],{},"使用 docker context(推荐)："," docker context 是目前官方最推荐的管理远程连接方式。它比传统的环境变量法更干净，不需要修改系统的环境变量，就能在多个不同的 Docker 服务器之间一键切换。",[169,2558,2559,2596,2613,2632],{},[172,2560,2561,2562],{},"创建全新的 Docker Context\n",[377,2563,2565],{"className":379,"code":2564,"language":381,"meta":382,"style":382},"docker context create tcp-docker-tls  --description \"虚拟机远程Docker-TCP-TLS\"  --docker \"host=tcp:\u002F\u002F192.168.1.7:2376,ca=C:\u002FUsers\u002FAdministrator\u002F.docker\u002Fcerts\u002Fca.pem,cert=C:\u002FUsers\u002FAdministrator\u002F.docker\u002Fcerts\u002Fcert.pem,key=C:\u002FUsers\u002FAdministrator\u002F.docker\u002Fcerts\u002Fkey.pem\"\n",[384,2566,2567],{"__ignoreMap":382},[387,2568,2569,2571,2573,2575,2578,2580,2582,2585,2587,2589,2591,2594],{"class":389,"line":390},[387,2570,1995],{"class":393},[387,2572,2057],{"class":397},[387,2574,2060],{"class":397},[387,2576,2577],{"class":397}," tcp-docker-tls",[387,2579,2231],{"class":397},[387,2581,465],{"class":464},[387,2583,2584],{"class":397},"虚拟机远程Docker-TCP-TLS",[387,2586,471],{"class":464},[387,2588,2135],{"class":397},[387,2590,465],{"class":464},[387,2592,2593],{"class":397},"host=tcp:\u002F\u002F192.168.1.7:2376,ca=C:\u002FUsers\u002FAdministrator\u002F.docker\u002Fcerts\u002Fca.pem,cert=C:\u002FUsers\u002FAdministrator\u002F.docker\u002Fcerts\u002Fcert.pem,key=C:\u002FUsers\u002FAdministrator\u002F.docker\u002Fcerts\u002Fkey.pem",[387,2595,640],{"class":464},[172,2597,2598,2599],{},"查看当前的 Context 列表\n",[377,2600,2602],{"className":379,"code":2601,"language":381,"meta":382,"style":382},"docker context ls\n",[384,2603,2604],{"__ignoreMap":382},[387,2605,2606,2608,2610],{"class":389,"line":390},[387,2607,1995],{"class":393},[387,2609,2057],{"class":397},[387,2611,2612],{"class":397}," ls\n",[172,2614,2615,2616],{},"切换并使用远程环境\n",[377,2617,2619],{"className":379,"code":2618,"language":381,"meta":382,"style":382},"docker context use tcp-docker-tls \n",[384,2620,2621],{"__ignoreMap":382},[387,2622,2623,2625,2627,2629],{"class":389,"line":390},[387,2624,1995],{"class":393},[387,2626,2057],{"class":397},[387,2628,2092],{"class":397},[387,2630,2631],{"class":397}," tcp-docker-tls\n",[172,2633,2634,2635],{},"如果您不想频繁切换环境，只是偶尔想在远程服务器上运行一个命令，可以使用 --context 参数：\n",[377,2636,2638],{"className":379,"code":2637,"language":381,"meta":382,"style":382},"docker --context tcp-docker-tls  ps\n",[384,2639,2640],{"__ignoreMap":382},[387,2641,2642,2644,2647,2649],{"class":389,"line":390},[387,2643,1995],{"class":393},[387,2645,2646],{"class":397}," --context",[387,2648,2577],{"class":397},[387,2650,2651],{"class":397},"  ps\n",[195,2653,2655],{"id":2654},"_5-vscode-通过插件连接远程-docker","5. VSCode 通过插件连接远程 Docker",[165,2657,2658,2659,2662],{},"在 VS Code 中，",[175,2660,2661],{},"Container Tools"," 是微软官方推出的 Docker 可视化扩展插件，已取代旧版 Docker 扩展。这个插件可通过图形界面形式直观地管理本地或远程的容器、镜像、卷、网络、Docker Context 及 Compose 项目，并支持右键快捷操作（启动\u002F停止、查看日志等）。",[165,2664,2665,2673],{},[2666,2667,2672],"a",{"href":2668,"rel":2669,"target":2671},"https:\u002F\u002Fmarketplace.visualstudio.com\u002Fitems?itemName=ms-azuretools.vscode-containers",[2670],"nofollow","_blank","点击直接安装Docker 扩展","。",[329,2675,2677],{"id":2676},"_51-安装并激活插件","5.1 安装并激活插件",[169,2679,2680,2683,2686],{},[172,2681,2682],{},"打开 VSCode，进入扩展市场（左侧活动栏的方块图标或快捷键 Ctrl+Shift+X）",[172,2684,2685],{},"搜索 Container Tools（发布者为 Microsoft）",[172,2687,2688],{},"点击安装，安装完成后插件自动激活",[165,2690,2691],{},"激活后，左侧活动栏会出现容器图标（🐳），点击即可打开 Docker 管理面板。",[329,2693,2695],{"id":2694},"_52-配置docker_host","5.2 配置DOCKER_HOST",[165,2697,2698,2699,2701],{},"安装并激活插件后，点击容器图标，你会发现可视化页面上没有任何容器、镜像信息——那是因为",[175,2700,2661],{}," 插件还没有配置可连接的 Docker 服务信息。",[165,2703,2704,2705,2708,2709,2711],{},"如果你本地没有Docker Cli客户端，你可以在 VScode 的",[384,2706,2707],{},"settings.json","文件中为",[175,2710,2661],{}," 插件配置DOCKER_HOST环境变量，通过DOCKER_HOST环境变量设置Docker服务端的连接地址，详细配置如下：",[377,2713,2715],{"className":763,"code":2714,"language":765,"meta":382,"style":382},"{\n    \"containers.environment\": {\n        \"DOCKER_HOST\": \"tcp:\u002F\u002F192.168.1.7:2375\"\n    }\n}\n",[384,2716,2717,2721,2735,2753,2758],{"__ignoreMap":382},[387,2718,2719],{"class":389,"line":390},[387,2720,772],{"class":464},[387,2722,2723,2725,2728,2730,2732],{"class":389,"line":432},[387,2724,777],{"class":464},[387,2726,2727],{"class":780},"containers.environment",[387,2729,471],{"class":464},[387,2731,786],{"class":464},[387,2733,2734],{"class":464}," {\n",[387,2736,2737,2739,2742,2744,2746,2748,2751],{"class":389,"line":444},[387,2738,794],{"class":464},[387,2740,2741],{"class":393},"DOCKER_HOST",[387,2743,471],{"class":464},[387,2745,786],{"class":464},[387,2747,465],{"class":464},[387,2749,2750],{"class":397},"tcp:\u002F\u002F192.168.1.7:2375",[387,2752,640],{"class":464},[387,2754,2755],{"class":389,"line":451},[387,2756,2757],{"class":464},"    }\n",[387,2759,2760],{"class":389,"line":457},[387,2761,821],{"class":464},[165,2763,2764],{},"然后重启 VSCode，插件便会连接上对应的 Docker 服务端，同时也能获取到容器、镜像等信息。",[695,2766,2767],{},[165,2768,2769],{},"建议：如果本地已安装 Docker CLI，更推荐使用下方的 Docker Context 方式，无需修改 settings.json。",[329,2771,2773],{"id":2772},"_53-切换-docker-context","5.3 切换 Docker Context",[165,2775,2776],{},"在管理面板的 DOCKER CONTEXTS 菜单中，会列出本地所有已创建的 Docker Context（如 ssh-docker、tcp-docker、tcp-docker-tls 等）：",[169,2778,2779,2782,2785],{},[172,2780,2781],{},"找到目标 Context 名称",[172,2783,2784],{},"右键点击，在弹出的菜单中选择 Use",[172,2786,2787],{},"插件即自动连接该 Context 对应的远程 Docker 服务",[195,2789,2791],{"id":2790},"_6-常用管理命令","6 常用管理命令",[203,2793,2794,2804],{},[206,2795,2796],{},[209,2797,2798,2801],{},[212,2799,2800],{},"操作",[212,2802,2803],{},"命令",[219,2805,2806,2814,2822,2830,2838,2846],{},[209,2807,2808,2811],{},[224,2809,2810],{},"查看当前 Context",[224,2812,2813],{},"docker context show",[209,2815,2816,2819],{},[224,2817,2818],{},"列出所有 Context",[224,2820,2821],{},"docker context ls",[209,2823,2824,2827],{},[224,2825,2826],{},"切换 Context",[224,2828,2829],{},"docker context use",[209,2831,2832,2835],{},[224,2833,2834],{},"删除 Context",[224,2836,2837],{},"docker context rm \u003C名称>",[209,2839,2840,2843],{},[224,2841,2842],{},"更新 Context 配置",[224,2844,2845],{},"docker context update \u003C名称> --docker host=...",[209,2847,2848,2851],{},[224,2849,2850],{},"临时使用指定 Context 执行命令",[224,2852,2853],{},"docker --context \u003C名称> ps",[195,2855,2857],{"id":2856},"_7-常见问题排查","7 常见问题排查",[203,2859,2860,2873],{},[206,2861,2862],{},[209,2863,2864,2867,2870],{},[212,2865,2866],{},"问题现象",[212,2868,2869],{},"可能原因",[212,2871,2872],{},"解决建议",[219,2874,2875,2886,2897,2908,2919,2930],{},[209,2876,2877,2880,2883],{},[224,2878,2879],{},"Cannot connect to the Docker daemon",[224,2881,2882],{},"远程Docker未启动或端口不通",[224,2884,2885],{},"检查systemctl status docker；检查防火墙和云安全组",[209,2887,2888,2891,2894],{},[224,2889,2890],{},"ssh: handshake failed",[224,2892,2893],{},"SSH免密登录未配置",[224,2895,2896],{},"先用ssh user@host测试能否免密登录；检查identity_file路径",[209,2898,2899,2902,2905],{},[224,2900,2901],{},"certificate signed by unknown authority",[224,2903,2904],{},"客户端未信任CA证书",[224,2906,2907],{},"检查--tlscacert路径和证书文件是否正确",[209,2909,2910,2913,2916],{},[224,2911,2912],{},"permission denied",[224,2914,2915],{},"远程用户不在docker组",[224,2917,2918],{},"执行sudo usermod -aG docker $USER并重新登录",[209,2920,2921,2924,2927],{},[224,2922,2923],{},"Context切换后未生效",[224,2925,2926],{},"当前context未正确切换",[224,2928,2929],{},"执行docker context show确认，重新use或重启终端",[209,2931,2932,2935,2938],{},[224,2933,2934],{},"VSCode不显示Context",[224,2936,2937],{},"插件未激活或未安装",[224,2939,2940],{},"确认已安装Container Tools扩展；重启VSCode",[195,2942,2944],{"id":2943},"_8-总结","8 总结",[165,2946,2947],{},"无论使用终端还是 VSCode，统一通过 docker context 管理所有连接配置。docker context 将连接信息持久化，支持一键切换，让本地、远程、云端等多环境管理变得非常轻松。",[203,2949,2950,2967],{},[206,2951,2952],{},[209,2953,2954,2956,2959,2962,2964],{},[212,2955,261],{},[212,2957,2958],{},"服务端配置",[212,2960,2961],{},"客户端配置",[212,2963,264],{},[212,2965,2966],{},"推荐场景",[219,2968,2969,2985,3001],{},[209,2970,2971,2973,2976,2979,2982],{},[224,2972,277],{},[224,2974,2975],{},"无需额外配置（复用现有SSH服务）",[224,2977,2978],{},"docker context create dev -H ssh:\u002F\u002Fuser@host",[224,2980,2981],{},"★★★★★",[224,2983,2984],{},"开发测试、日常管理（首选方案）",[209,2986,2987,2989,2992,2995,2998],{},[224,2988,291],{},[224,2990,2991],{},"修改daemon.json + 开放2375端口",[224,2993,2994],{},"docker context create dev -H tcp:\u002F\u002Fhost:2375",[224,2996,2997],{},"☆☆☆☆☆",[224,2999,3000],{},"仅限内网隔离测试",[209,3002,3003,3005,3008,3011,3013],{},[224,3004,305],{},[224,3006,3007],{},"生成证书 + 修改配置 + 开放 2376 端口",[224,3009,3010],{},"docker context create dev -H tcp:\u002F\u002Fhost:2376 --docker ca=...",[224,3012,2981],{},[224,3014,314],{},[3016,3017,3018],"style",{},"html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sbssI, html code.shiki .sbssI{--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}",{"title":382,"searchDepth":444,"depth":444,"links":3020},[3021,3022,3023,3039,3044,3049,3050,3051],{"id":197,"depth":432,"text":198},{"id":248,"depth":432,"text":249},{"id":323,"depth":432,"text":324,"children":3024},[3025,3030,3035],{"id":331,"depth":444,"text":332,"children":3026},[3027,3028,3029],{"id":347,"depth":451,"text":348},{"id":643,"depth":451,"text":644},{"id":667,"depth":451,"text":668},{"id":689,"depth":444,"text":690,"children":3031},[3032,3033,3034],{"id":716,"depth":451,"text":717},{"id":956,"depth":451,"text":957},{"id":989,"depth":451,"text":990},{"id":1070,"depth":444,"text":1071,"children":3036},[3037,3038],{"id":1077,"depth":451,"text":1078},{"id":1649,"depth":451,"text":1650},{"id":1969,"depth":432,"text":1970,"children":3040},[3041,3042,3043],{"id":1976,"depth":444,"text":1977},{"id":2166,"depth":444,"text":2167},{"id":2302,"depth":444,"text":2303},{"id":2654,"depth":432,"text":2655,"children":3045},[3046,3047,3048],{"id":2676,"depth":444,"text":2677},{"id":2694,"depth":444,"text":2695},{"id":2772,"depth":444,"text":2773},{"id":2790,"depth":432,"text":2791},{"id":2856,"depth":432,"text":2857},{"id":2943,"depth":432,"text":2944},"2026-07-28 10:06:00","md",{},{"title":133},24.4,{"title":160,"description":136},{"loc":134},"2026-08-20 11:23:00",4385,"2DKzZTcK-uFjqLH6_FyhsPeYOLj1GU4biInAmoQi4tk",{"data":3063,"body":3064},{},{"type":3065,"children":3066},"root",[3067],{"type":3068,"tag":165,"props":3069,"children":3070},"element",{},[3071],{"type":3072,"value":136},"text",1787625813057]