github.com/rumpl/bof@v23.0.0-rc.2+incompatible/cmd/dockerd/options.go (about) 1 package main 2 3 import ( 4 "os" 5 "path/filepath" 6 7 cliconfig "github.com/docker/docker/cli/config" 8 "github.com/docker/docker/daemon/config" 9 "github.com/docker/docker/opts" 10 "github.com/docker/go-connections/tlsconfig" 11 "github.com/spf13/pflag" 12 ) 13 14 const ( 15 // DefaultCaFile is the default filename for the CA pem file 16 DefaultCaFile = "ca.pem" 17 // DefaultKeyFile is the default filename for the key pem file 18 DefaultKeyFile = "key.pem" 19 // DefaultCertFile is the default filename for the cert pem file 20 DefaultCertFile = "cert.pem" 21 // FlagTLSVerify is the flag name for the TLS verification option 22 FlagTLSVerify = "tlsverify" 23 // FlagTLS is the flag name for the TLS option 24 FlagTLS = "tls" 25 // DefaultTLSValue is the default value used for setting the tls option for tcp connections 26 DefaultTLSValue = false 27 ) 28 29 var ( 30 dockerCertPath = os.Getenv("DOCKER_CERT_PATH") 31 dockerTLSVerify = os.Getenv("DOCKER_TLS_VERIFY") != "" 32 ) 33 34 type daemonOptions struct { 35 configFile string 36 daemonConfig *config.Config 37 flags *pflag.FlagSet 38 Debug bool 39 Hosts []string 40 LogLevel string 41 TLS bool 42 TLSVerify bool 43 TLSOptions *tlsconfig.Options 44 Validate bool 45 } 46 47 // newDaemonOptions returns a new daemonFlags 48 func newDaemonOptions(config *config.Config) *daemonOptions { 49 return &daemonOptions{ 50 daemonConfig: config, 51 } 52 } 53 54 // installFlags adds flags for the common options on the FlagSet 55 func (o *daemonOptions) installFlags(flags *pflag.FlagSet) { 56 if dockerCertPath == "" { 57 // cliconfig.Dir returns $DOCKER_CONFIG or ~/.docker. 58 // cliconfig.Dir does not look up $XDG_CONFIG_HOME 59 dockerCertPath = cliconfig.Dir() 60 } 61 62 flags.BoolVarP(&o.Debug, "debug", "D", false, "Enable debug mode") 63 flags.BoolVar(&o.Validate, "validate", false, "Validate daemon configuration and exit") 64 flags.StringVarP(&o.LogLevel, "log-level", "l", "info", `Set the logging level ("debug"|"info"|"warn"|"error"|"fatal")`) 65 flags.BoolVar(&o.TLS, FlagTLS, DefaultTLSValue, "Use TLS; implied by --tlsverify") 66 flags.BoolVar(&o.TLSVerify, FlagTLSVerify, dockerTLSVerify || DefaultTLSValue, "Use TLS and verify the remote") 67 68 o.TLSOptions = &tlsconfig.Options{} 69 tlsOptions := o.TLSOptions 70 flags.StringVar(&tlsOptions.CAFile, "tlscacert", filepath.Join(dockerCertPath, DefaultCaFile), "Trust certs signed only by this CA") 71 flags.StringVar(&tlsOptions.CertFile, "tlscert", filepath.Join(dockerCertPath, DefaultCertFile), "Path to TLS certificate file") 72 flags.StringVar(&tlsOptions.KeyFile, "tlskey", filepath.Join(dockerCertPath, DefaultKeyFile), "Path to TLS key file") 73 74 hostOpt := opts.NewNamedListOptsRef("hosts", &o.Hosts, opts.ValidateHost) 75 flags.VarP(hostOpt, "host", "H", "Daemon socket(s) to connect to") 76 } 77 78 // setDefaultOptions sets default values for options after flag parsing is 79 // complete 80 func (o *daemonOptions) setDefaultOptions() { 81 // Regardless of whether the user sets it to true or false, if they 82 // specify --tlsverify at all then we need to turn on TLS 83 // TLSVerify can be true even if not set due to DOCKER_TLS_VERIFY env var, so we need 84 // to check that here as well 85 if o.flags.Changed(FlagTLSVerify) || o.TLSVerify { 86 o.TLS = true 87 } 88 89 if o.TLS && !o.flags.Changed(FlagTLSVerify) { 90 // Enable tls verification unless explicitly disabled 91 o.TLSVerify = true 92 } 93 94 if !o.TLS { 95 o.TLSOptions = nil 96 } else { 97 o.TLSOptions.InsecureSkipVerify = !o.TLSVerify 98 99 // Reset CertFile and KeyFile to empty string if the user did not specify 100 // the respective flags and the respective default files were not found. 101 if !o.flags.Changed("tlscert") { 102 if _, err := os.Stat(o.TLSOptions.CertFile); os.IsNotExist(err) { 103 o.TLSOptions.CertFile = "" 104 } 105 } 106 if !o.flags.Changed("tlskey") { 107 if _, err := os.Stat(o.TLSOptions.KeyFile); os.IsNotExist(err) { 108 o.TLSOptions.KeyFile = "" 109 } 110 } 111 } 112 }