如何在WSL2上公开Docker TCP套接字？ （安装了WSL的Docker，而不是Docker Desktop）

时间：2020-08-14 16:03:49

标签： docker windows-subsystem-for-linux wsl-2 docker-daemon

我想通过PyCharm连接到WSL2中运行的Docker TCP套接字。我似乎无法公开套接字，我想可能是因为WSL2（systemctl）对docker-daemon的控制有限吗？我不能使用Docker Desktop，因为我需要GPU支持（Windows Dev Channel + nvidia-docker）。我尝试了以下方法：

export DOCKER_HOST = tcp：//0.0.0.0：2375 

$ export DOCKER_HOST=tcp://0.0.0.0:2375
$ sudo service docker restart
$ docker context ls
NAME                DESCRIPTION                               DOCKER ENDPOINT      KUBERNETES ENDPOINT   ORCHESTRATOR
default *           Current DOCKER_HOST based configuration   tcp://0.0.0.0:2375                         swarm
Warning: DOCKER_HOST environment variable overrides the active context. To use a context, either set the global --context flag, or unset DOCKER_HOST environment variable.
$ curl --unix-socket /var/run/docker.sock http:/localhost/version
{"Platform":{"Name":"Docker Engine - Community"},"Components":[{"Name":"Engine","Version":"19.03.11","Details":{"ApiVersion":"1.40","Arch":"amd64","BuildTime":"2020-06-01T09:10:54.000000000+00:00","Experimental":"false","GitCommit":"42e35e61f3","GoVersion":"go1.13.10","KernelVersion":"4.19.121-microsoft-standard","MinAPIVersion":"1.12","Os":"linux"}},{"Name":"containerd","Version":"1.2.13","Details":{"GitCommit":"7ad184331fa3e55e52b890ea95e65ba581ae3429"}},{"Name":"runc","Version":"1.0.0-rc10","Details":{"GitCommit":"dc9208a3303feef5b3839f4323d9beb36df0a9dd"}},{"Name":"docker-init","Version":"0.18.0","Details":{"GitCommit":"fec3683"}}],"Version":"19.03.11","ApiVersion":"1.40","MinAPIVersion":"1.12","GitCommit":"42e35e61f3","GoVersion":"go1.13.10","Os":"linux","Arch":"amd64","KernelVersion":"4.19.121-microsoft-standard","BuildTime":"2020-06-01T09:10:54.000000000+00:00"}
$ curl http://localhost:2375/version
curl: (7) Failed to connect to localhost port 2375: Connection refused

我希望最终的命令给出类似{"Version":"17.05.0-ce","ApiVersion":"...}的结果，但是连接被拒绝。确实，如果我尝试通过Windows主机Pycharm连接，它将拒绝连接。我还看到很多教程/ SO帖子都说不要使用这种DOCKER_HOST方法，但是我不确定为什么。

/lib/systemd/system/docker.service> ExecStart

对于每个stackoverflow，serverfault，ivankrizsan，我用/lib/systemd/system/docker.service编辑了ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock -H tcp://0.0.0.0:2375。但是当我尝试systemctl daemon-reload时会出错； WSL2不支持systemctl命令（WSL/457）。

$ sudo systemctl daemon-reload
System has not been booted with systemd as init system (PID 1). Can't operate.

我还尝试重新启动WSL2（Powershell wsl --shutdown，重新打开WSL2），以防docker-daemon捡起那些变化，但没有雪茄。

$ curl http://localhost:2375/version
curl: (7) Failed to connect to localhost port 2375: Connection refused

/ etc / default / docker> DOCKER_OPTS

对于每个stackoverflow，我先用/etc/default/docker然后用DOCKER_OPTS="-H unix:// -H tcp://0.0.0.0:2375"编辑了sudo service docker restart。同一连接拒绝错误。

1 个答案:

答案 0 :(得分：2)

快速修复（不安全）

来自Gist

1。 /etc/docker/daemon.json 

{"hosts": ["tcp://0.0.0.0:2375", "unix:///var/run/docker.sock"]}

2。 sudo service docker restart

长效（TLS）

TLS支持：more detailed serverfault，step-by-step blog post。如果要在服务器上设置Docker，建议您关注该博客文章。对我来说，我只想要WSL2中的Docker，Windows可以访问的套接字（PyCharm）和TLS安全。因此，我的修改使用了~/.docker和localhost（而不是根文件夹和FQDN）。这是我的步骤：

1。 /etc/docker/daemon.json 

"hosts": ["unix:///var/run/docker.sock", "tcp://0.0.0.0:2376"],
"tlscacert": "/home/lefnire/.docker/certs/ca.pem",
"tlscert": "/home/lefnire/.docker/certs/server-cert.pem",
"tlskey": "/home/lefnire/.docker/certs/server-key.pem",
"tlsverify": true

请注意，我使用的是~/.docker/certs而不是/etc/docker/certs。我遇到PyCharm遇到的权限障碍，即使尝试chmod -v 0444 x也需要访问“证书文件夹”。

2。证书

$ mkdir ~/.docker/certs
$ cd ~/.docker/certs
$ openssl genrsa -aes256 -out ca-key.pem 4096  # enter passphrase
$ openssl req -new -x509 -days 365 -key ca-key.pem -sha256 -out ca.pem  # enter localhost at FQDN step
$ openssl genrsa -out server-key.pem 4096
$ openssl req -subj "/CN=localhost" -sha256 -new -key server-key.pem -out server.csr
$ openssl x509 -req -days 365 -sha256 -in server.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out server-cert.pem
$ echo subjectAltName = DNS:localhost,IP:127.0.0.1 >> extfile.cnf
$ echo extendedKeyUsage = serverAuth >> extfile.cnf
$ openssl x509 -req -days 365 -sha256 -in server.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out server-cert.pem -extfile extfile.cnf
$ openssl genrsa -out key.pem 4096
$ openssl req -subj '/CN=client' -new -key key.pem -out client.csr
$ echo extendedKeyUsage = clientAuth > extfile-client.cnf
$ openssl x509 -req -days 365 -sha256 -in client.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out cert.pem -extfile extfile-client.cnf

忽略openssl RAND错误（或fix it）

3。 sudo service docker restart

4。 PyCharm（可选）

  1. 文件>设置>构建，执行，部署> Docker
    1. 添加Docker（或单击现有）> [x] TCP套接字
    2. 引擎API URL：https://localhost:2376
    3. 证书文件夹：\\wsl$\Ubuntu-18.04\home\lefnire\.docker\certs
  2. 文件>设置>项目：[my-proj]> Python解释器
    1. 下拉菜单>显示全部...>添加> Docker
相关问题
最新问题