Jtdylktuy

I am running docker-toolbox in my Windows 10 PC. By default, docker-toolbox installs boot2docker in VirtualBox VM with one NAT interface and one Host-Only interface. The NAT interface (eth0 10.0.2.15/24) is connected to Internet and the Host-Only interface (eth1 192.168.99.104/24) is connected to the Host OS. The network packets coming from Host-Only interface are encrypted with TLS protocol, so the data looks like garbage in any packet capturing tool.

So, How can I view what are written in those encrypted network packets coming from Host-Only interface?

Warning: The following procedure disables TLS protocol. docker-toolbox uses TLS to secure the connection between docker daemon and docker clients. Disabling this secure channel makes your docker system vulnerable to security threats.

To create boot2docker VirtualBox VM with TLS disabled, follow this SO answer. If that VM is already created follow these steps. Start that VM from VirtualBox Manager or SSH into that VM with docker-machine ssh <vm-name> command. Run this command vi /var/lib/boot2docker/profile to edit file in vi editor.

• Default values are:

DOCKER_HOST='-H tcp://0.0.0.0:2376'

DOCKER_TLS=yes

• Change those as following:

DOCKER_HOST='-H tcp://0.0.0.0:2375'

DOCKER_TLS=no

DOCKER_TLS_VERIFY=no

Then exit from vi editor and restart dockerd daemon with this command sudo /etc/init.d/docker restart. Or exit from ssh session and reboot boot2docker VM. Here are the network packets in plain text after running docker system info command:

C:> tshark.exe -i Host-Only -f "tcp port 2375"

Capturing on 'Host-Only'

192.168.99.1 → 192.168.99.104 TCP 62827 → 2375 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM=1

192.168.99.104 → 192.168.99.1 TCP 2375 → 62827 [SYN, ACK] Seq=0 Ack=1 Win=29200 Len=0 MSS=1460 SACK_PERM=1 WS=128

192.168.99.1 → 192.168.99.104 TCP 62827 → 2375 [ACK] Seq=1 Ack=1 Win=1051136 Len=0

192.168.99.1 → 192.168.99.104 HTTP GET /_ping HTTP/1.1

192.168.99.104 → 192.168.99.1 TCP 2375 → 62827 [ACK] Seq=1 Ack=99 Win=29312 Len=0

192.168.99.104 → 192.168.99.1 HTTP HTTP/1.1 200 OK  (text/plain)

192.168.99.1 → 192.168.99.104 HTTP GET /v1.37/info HTTP/1.1

192.168.99.104 → 192.168.99.1 TCP HTTP/1.1 200 OK  [TCP segment of a reassembled PDU]

192.168.99.104 → 192.168.99.1 HTTP HTTP/1.1 200 OK  (application/json)

192.168.99.1 → 192.168.99.104 TCP 62827 → 2375 [ACK] Seq=202 Ack=3039 Win=1051136 Len=0

192.168.99.1 → 192.168.99.104 TCP 62827 → 2375 [RST, ACK] Seq=202 Ack=3039 Win=0 Len=0

11 packets captured

So, how does this work? DOCKER_HOST and DOCKER_TLS are environment variables used in docker engine. DOCKER_TLS=no disables TLS encryption and port 2375 is default port used without encryption. By changing those values in /var/lib/boot2docker/profile file, docker daemon always accept those parameters. Because /var/lib is the persistent drive in boot2docker VM. Here are some quotes (Source):

Docker daemon options
If you need to customize the options used to start the Docker daemon, you can do so by adding entries to the /var/lib/boot2docker/profile file on the persistent partition inside the Boot2Docker virtual machine. Then restart the daemon.

When you run docker-machine, the tool auto-creates a disk that will be automounted and used to persist your docker data in /var/lib/docker and /var/lib/boot2docker.

See this article for further information.