Docker: Encrypting credentials

The following steps describe how to store credentials using pass with GnuPG on Debian-based linux distributions, such as Ubuntu. To see a list of the other credential stores supported by Docker, please see the official documentation.

Install pass and GPG

1. Install rng-tools

sudo apt-get install rng-tools -y

2. Once the installation completes, generate the required entropy with

sudo rngd -r /dev/urandom

3. Next, install the pass tool

sudo apt-get install pass -y

4. Generate a new GPG key (accept all of the default options)

gpg --full-generate-key

Install docker-credential-pass

One way to install docker-credentials pass is by running the script at

Deploy/scripts/install_docker-credentials-pass.sh

Alternatively, follow the 'Installation' instructions in the docker-credential-helpers documentation.

Initialise pass

1. Find the ID of your GPG key:

gpg --list-secret-keys

2. Initialise pass with that ID

pass init ID_STRING

Set up Docker to use the credential store

1. Create a password:

pass insert docker-credential-helpers/docker-pass-initialized-check

2. Create a docker config file, if one doesn't exist already

touch ~/.docker/config.json

3. Add the following to the config file, then save and close.

  {
  "experimental": "enabled"
  }

Fudge to make GPG work properly

For some reason, the GPG_TTY environment variable needs to be set manually. Add the following to your ~/.bashrc:

export GPG_TTY=$(tty)

Then reload it with

source ~/.bashrc

Login to a registry

Finally, to store credentials, login to a registry. e.g.:

docker login docker.cmclinnovations.com -u <user_name>