dotcloud/docker — pull request #3070 by alexlarsson (2013-12-05 17:59:24+00:00)
Title: Add support for certificates for repositories

This adds support for a /etc/docker-certs configuration file that allows you to specify tls certificate config.

Currently it has two settings:
1) You can specify a list of root CAs in case you're using an https repository that is not signed by a default CA

2) You can specify a per-repository client side certificate and private key to send to the server. This allows the server to e.g. verify that the client is allowed to access a particular image.

I've set up a local apache that serves as a registry with "SSLVerifyClient optional_no_ca" and a cgi script that verifies that you have a valid client side certificate. It works:

```
# wget --ca-certificate=/etc/pki/tls/certs/localhost.crt https://127.0.0.1/v1/_ping
--2013-12-05 18:59:57-- https://127.0.0.1/v1/_ping
Connecting to 127.0.0.1:443... connected.
HTTP request sent, awaiting response... 403 Client certificate invalid
2013-12-05 18:59:57 ERROR 403: Client certificate invalid.

# docker run 127.0.0.1/busybox echo hello
Unable to find image '127.0.0.1/busybox' (tag: latest) locally
Pulling repository 127.0.0.1/busybox
e9aa60c60128: Pulling image (latest) from 127.0.0.1/busybox
e9aa60c60128: Pulling image (latest) from 127.0.0.1/busybox, endpoint: https://127.0.0.1/v1/
e9aa60c60128: Pulling dependent layers
e9aa60c60128: Pulling metadata
e9aa60c60128: Pulling fs layer
e9aa60c60128: Downloading 532.3 kB
e9aa60c60128: Download complete
hello
```

With the following /etc/docker-certs
```
{
"roots": ["/etc/pki/tls/certs/ca-bundle.crt", "/etc/pki/tls/certs/localhost.crt"],
"hosts": {
"127.0.0.1": {
"cert": "/home/alex/client.cert",
"key": "/home/alex/client.key"
}
}
}
```