fix typos
Signed-off-by: allencloud <allen.sun@daocloud.io> Upstream-commit: c1be45fa38e82054dcad606d71446a662524f2d5 Component: engine
This commit is contained in:
@ -12,7 +12,7 @@ parent = "smn_secure_docker"
|
||||
# Protect the Docker daemon socket
|
||||
|
||||
By default, Docker runs via a non-networked Unix socket. It can also
|
||||
optionally communicate using a HTTP socket.
|
||||
optionally communicate using an HTTP socket.
|
||||
|
||||
If you need Docker to be reachable via the network in a safe manner, you can
|
||||
enable TLS by specifying the `tlsverify` flag and pointing Docker's
|
||||
|
||||
@ -107,7 +107,7 @@ Trust for an image tag is managed through the use of signing keys. A key set is
|
||||
created when an operation using content trust is first invoked. A key set consists
|
||||
of the following classes of keys:
|
||||
|
||||
- an offline key that is the root of content trust for a image tag
|
||||
- an offline key that is the root of content trust for an image tag
|
||||
- repository or tagging keys that sign tags
|
||||
- server-managed keys such as the timestamp key, which provides freshness
|
||||
security guarantees for your repository
|
||||
|
||||
@ -67,7 +67,7 @@ e is 65537 (0x10001)
|
||||
They should keep `delegation.key` private - this is what they will use to sign
|
||||
tags.
|
||||
|
||||
Then they need to generate a x509 certificate containing the public key, which is
|
||||
Then they need to generate an x509 certificate containing the public key, which is
|
||||
what they will give to you. Here is the command to generate a CSR (certificate
|
||||
signing request):
|
||||
|
||||
|
||||
@ -15,7 +15,7 @@ trust makes use of five different types of keys:
|
||||
|
||||
| Key | Description |
|
||||
|---------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| root key | Root of content trust for a image tag. When content trust is enabled, you create the root key once. Also known as the offline key, because it should be kept offline. |
|
||||
| root key | Root of content trust for an image tag. When content trust is enabled, you create the root key once. Also known as the offline key, because it should be kept offline. |
|
||||
| targets | This key allows you to sign image tags, to manage delegations including delegated keys or permitted delegation paths. Also known as the repository key, since this key determines what tags can be signed into an image repository. |
|
||||
| snapshot | This key signs the current collection of image tags, preventing mix and match attacks.
|
||||
| timestamp | This key allows Docker image repositories to have freshness security guarantees without requiring periodic content refreshes on the client's side. |
|
||||
|
||||
Reference in New Issue
Block a user