1. docker
  2. Commit f9657819cdd9ea2a9327887db1c5a4aa405ffae9
Browse code

docker-login man/doc add security info

Signed-off-by: Sally O'Malley <somalley@redhat.com>

Sally O'Malley authored on 2015/11/03 07:20:38
Showing 2 changed files
docs/reference/commandline/login.md
History View file @ f965781
... ... 
@@ -25,3 +25,16 @@ adding the server name.
25 25
26 26 
     example:
27 27 
     $ docker login localhost:8080
28 
+
29 
+
30 
+`docker login` requires user to use `sudo` or be `root`, except when:
31 
+
32 
+1.  connecting to a remote daemon, such as a `docker-machine` provisioned `docker engine`.
33 
+2.  user is added to the `docker` group.  This will impact the security of your system; the `docker` group is `root` equivalent.  See [Docker Daemon Attack Surface](https://docs.docker.com/articles/security/#docker-daemon-attack-surface) for details.
34 
+
35 
+You can log into any public or private repository for which you have
36 
+credentials.  When you log in, the command stores encoded credentials in
37 
+`$HOME/.docker/config.json` on Linux or `%USERPROFILE%/.docker/config.json` on Windows.
38 
+
39 
+> **Note**:  When running `sudo docker login` credentials are saved in `/root/.docker/config.json`.
40 
+>
man/docker-login.1.md
History View file @ f965781
... ... 
@@ -18,10 +18,18 @@ Register or log in to a Docker Registry located on the specified
18 18 
 do not specify a `SERVER`, the command uses Docker's public registry located at
19 19 
 `https://registry-1.docker.io/` by default.  To get a username/password for Docker's public registry, create an account on Docker Hub.
20 20
21 
+`docker login` requires user to use `sudo` or be `root`, except when:
22 
+
23 
+1.  connecting to  a remote daemon, such as a `docker-machine` provisioned `docker engine`.
24 
+2.  user is added to the `docker` group.  This will impact the security of your system; the `docker` group is `root` equivalent.  See [Docker Daemon Attack Surface](https://docs.docker.com/articles/security/#docker-daemon-attack-surface) for details.
25 
+
21 26 
 You can log into any public or private repository for which you have
22 27 
 credentials.  When you log in, the command stores encoded credentials in
23 28 
 `$HOME/.docker/config.json` on Linux or `%USERPROFILE%/.docker/config.json` on Windows.
24 29
30 
+> **Note**: When running `sudo docker login` credentials are saved in `/root/.docker/config.json`.
31 
+>
32 
+
25 33 
 # OPTIONS
26 34 
 **-e**, **--email**=""
27 35 
    Email
... ... 
@@ -49,3 +57,4 @@ April 2014, Originally compiled by William Henry (whenry at redhat dot com)
49 49 
 based on docker.com source material and internal work.
50 50 
 June 2014, updated by Sven Dowideit <SvenDowideit@home.org.au>
51 51 
 April 2015, updated by Mary Anthony for v2 <mary@docker.com>
52 
+November 2015, updated by Sally O'Malley <somalley@redhat.com>