The document discusses using the Docker Remote API and docker-py Python library to interact with Docker containers remotely. It shows how to generate TLS certificates to securely connect to the Docker daemon, make API calls to list images, pull an image, create and start a container, and check the running container. Python code is provided that uses docker-py to connect over TLS, create and start a container, and verify it is running.

1. Docker Remote API &
docker-py
Eric Ahn
2016/07

2. $ docker-machine create -d virtualbox default
$ docker-machine env default
$ docker-machine ls default
$ curl https://192.168.99.100:2376/images/json
—cert $DOCKER_CERT_PATH/cert.pem
—key $DOCKER_CERT_PATH/key.pem
—cacert $DOCKER_CERT_PATH/ca.pem
curl: (58) SSL: Can't load the certificate "/Users/EricAhn/.docker/machine/
machines/default/cert.pem" and its private key: OSStatus -25299
password?

3. $ cd ~/.docker/machine/machines/default
$ openssl pkcs12 -export
> -inkey key.pem
> -in cert.pem
> -CAfile ca.pem
> -name client-side
> -out cert.p12
> -password pass:mypass
$ curl https://192.168.99.100:2376/images/json
—cert $DOCKER_CERT_PATH/cert.p12
—pass mypass
—key $DOCKER_CERT_PATH/key.pem
—cacert $DOCKER_CERT_PATH/ca.pem
[{"Id":"sha256:0d409d33b27e47423b049f7f863faa08655a8c901749c2b25b93ca6
7d01a470d","ParentId":"","RepoTags":["nginx:latest"],"RepoDigests":null,"Created":
1464804059,"Size":182786784,"VirtualSize":182786784,"Labels":{}}]
Generate cert.p12
with password
List images :
“nginx:latest”
Result

4. $ curl -X POST https://192.168.99.100:2376/images/create?fromImage=nginx:latest
—cert $DOCKER_CERT_PATH/cert.p12
—pass mypass
—key $DOCKER_CERT_PATH/key.pem
—cacert $DOCKER_CERT_PATH/ca.pem
{"status":"Pulling from library/nginx","id":"latest"}
{"status":"Digest:
sha256:0fe6413f3e30fcc5920bc8fa769280975b10b1c26721de956e1428b9e2f29d04"}
{"status":"Status: Image is up to date for nginx:latest"}
$ docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
nginx latest 0d409d33b27e 7 weeks ago 182.8 MB
Download “nginx:latest” image
Result
Check using command line

5. $ curl -v -X POST -H "Content-Type: application/json" -d '
{ "Image": "nginx"
}' https://192.168.99.100:2376/containers/create
--cert $DOCKER_CERT_PATH/cert.p12
--pass mypass
--key $DOCKER_CERT_PATH/key.pem
--cacert $DOCKER_CERT_PATH/ca.pem
{"Id":"8c6e0e97330c08461cdfc179a524ad56c2b0c3a2ba95fc5909a999d
75eb44b37","Warnings":null}
Create container
Result a message

6. $ curl -X POST -H "Content-Type: application/json"
> -d '{ "PortBindings": {"80/tcp": [{ "HostPort": "80"}]} }'
> https://192.168.99.100:2376/containers/8c6e0e97330c/start
> --cert $DOCKER_CERT_PATH/cert.p12
> --pass mypass
> --key $DOCKER_CERT_PATH/key.pem
> --cacert $DOCKER_CERT_PATH/ca.pem
{"message":"starting container with HostConfig was deprecated
since v1.10 and removed in v1.12"}
Set a specific HostConfig
Result : Failed with
HostConfig

7. $ curl -v https://192.168.99.100:2376/containers/json?all=1
--cert $DOCKER_CERT_PATH/cert.p12
--pass mypass
--key $DOCKER_CERT_PATH/key.pem
--cacert $DOCKER_CERT_PATH/ca.pem
[{"Id":"4ee9a6f6b24715266ae8037fd069e2439d67c0198ee8f96b531682d61363f527","Na
mes":["/
hello"],"Image":"nginx:latest","ImageID":"sha256:0d409d33b27e47423b049f7f863faa08655
a8c901749c2b25b93ca67d01a470d","Command":"nginx -g 'daemon off;'","Created":
1469639718,"Ports":[{"PrivatePort":443,"Type":"tcp"},{"IP":"0.0.0.0","PrivatePort":
80,"PublicPort":80,"Type":"tcp"}],"Labels":{},"State":"running","Status":"Up 14
minutes","HostConfig":{"NetworkMode":"default"},"NetworkSettings":{"Networks":{"bridge":
{"IPAMConfig":null,"Links":null,"Aliases":null,"NetworkID":"f22986e826e252df0d0f06011158
9f0a732993c6636ba47e549911ccaf8f8ed8","EndpointID":"41513d5005aa2777561b6c0c
d3f3f6ae44fa7d6d47d261734391e206cdade7b6","Gateway":"172.17.0.1","IPAddress":"17
2.17.0.2","IPPrefixLen":16,"IPv6Gateway":"","GlobalIPv6Address":"","GlobalIPv6PrefixLen":
0,"MacAddress":"02:42:ac:11:00:02"}}},"Mounts":[]}]
List all containers
Result ( json )

8. $ curl -X POST -H "Content-Type: application/json"
https://192.168.99.100:2376/containers/8c6e0e97330c/start
--cert $DOCKER_CERT_PATH/cert.p12
--pass mypass
--key $DOCKER_CERT_PATH/key.pem
--cacert $DOCKER_CERT_PATH/ca.pem
$ docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
8c6e0e97330c nginx "nginx -g 'daemon off" 2 minutes ago Up 1 seconds 80/tcp, 443/tcp goofy_ardinghelli
Start a container
Running status

9. $ cd ~/_Python
$ sudo easy_install pip
$ sudo pip install virtualenv
$ virtualenv foobar
$ source foobar/bin/activate
(foobar) $ pip install docker-py
Collecting docker-py
Downloading docker_py-1.9.0-py2.py3-none-any.whl (42kB)
Collecting requests>=2.5.2 (from docker-py)
Downloading requests-2.10.0-py2.py3-none-any.whl (506kB)
100% | | 512kB 938kB/s
Collecting six>=1.4.0 (from docker-py)
Downloading six-1.10.0-py2.py3-none-any.whl
Collecting websocket-client>=0.32.0 (from docker-py)
Downloading websocket_client-0.37.0.tar.gz (194kB)
100% | | 194kB 1.4MB/s
Collecting backports.ssl-match-hostname>=3.5; python_version < "3.5" (from docker-py)
Downloading backports.ssl_match_hostname-3.5.0.1.tar.gz
Building wheels for collected packages: websocket-client, backports.ssl-match-hostname
Running setup.py bdist_wheel for websocket-client ... done
Stored in directory: /Users/EricAhn/Library/Caches/pip/wheels/e4/20/12/48d6732b88733a0a8f98ee1a5b2f59b64b27011d5c34c4f98c
…..
Install python and virtualenv

10. (foobar) $ vi docker-run.py
import docker
tls_config = docker.tls.TLSConfig(
client_cert=('/Users/EricAhn/.docker/machine/machines/default/cert.pem',
'/Users/EricAhn/.docker/machine/machines/default/key.pem'),
verify='/Users/EricAhn/.docker/machine/machines/default/ca.pem'
)
client = docker.Client(base_url='tcp://192.168.99.100:2376', tls=tls_config)
client.containers()
container_id = client.create_container(
image='nginx:latest',
ports=[80],
name='hello'
)
client.start(
container_id,
port_bindings={80: ('0.0.0.0', 80)}
)
$ python docker-run.py
$ docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
4ee9a6f6b247 nginx:latest "nginx -g 'daemon off" 2 seconds ago Up 1 seconds 0.0.0.0:80->80/tcp, 443/tcp hello
Python code
Run code and check