Loading

×Sorry to interrupt
Uncaught ReferenceError: addCTracking is not defined
throws at https://kb.vmware.com/resource/KM_TealiumTrackingJS?v=0.5:100:1

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

Credential Helper Configuration Documentation (78026)

Last Updated: 4/16/2020Categories: How toTotal Views: 3614Language:
English

Subscribe to get an email
newsletter with new updates

Please provide article feedback:

Solution

Introduction

Certificate configuration

Linux

Windows 10

Windows 7

Mac OS

Proxy configuration

Linux

Windows 10

Windows 7

Mac OS

Introduction

The plain Docker login interface 'docker login' stores the user login credential on Docker client, which could be vulnerable for leaking vSphere user credential. This vRegistry / Harbor docker credential helper is to address this security risk and provide a secure way for vSphere users to login via docker CLI.

This documentation covers mainly the certificate and proxy configurations for Linux, Windows and Mac OS.

Certificate configuration

Linux

Login to the vsphere UI, navigate to the Image Registry option under Configure tab for the cluster and click on Download SSL Root Certificate to save the registry CA certificate to local and save it as ca.crt.

Get the Harbor cert and save it to the following location:

/etc/docker/certs.d/192.168.123.2/ca.crt

Restart docker

Windows 10

Login to the vsphere UI, navigate to the Image Registry option under Configure tab for the cluster and click on Download SSL Root Certificate to save the registry CA certificate to local and save it as ca.crt.

Install the certificate on Windows:

Open Windows Explorer, right-click the file you’ve downloaded, and choose Install certificate.

Then, select the following options:

Store location: local machine

Check place all certificates in the following store

Click Browser, and select Trusted Root Certificate Authorities

Click Finish

Copy the cert obtained from step 1 to the following location on your local:

C:\ProgramData\Docker\certs.d\<harbor_ip>\ca.crt

Restart docker

Windows 7

Login to the vsphere UI, navigate to the Image Registry option under Configure tab for the cluster and click on Download SSL Root Certificate to save the registry CA certificate to local and save it as ca.crt.

Install the certificate on Windows by following the steps mentioned below:

Open Windows Explorer, right-click the file you’ve downloaded, and choose Install certificate.

Then, select the following options:

Store location: local machine

Check place all certificates in the following store

Click Browser, and select Trusted Root Certificate Authorities

Click Finish

Copy the cert obtained from step 1 to the following location on your local:

C:\ProgramData\Docker\certs.d\<harbor_ip>\ca.crt

To copy the cert obtained from step 1 to the following docker's cert store, run these commands:

docker-machine ssh default

sudo -s

mkdir /var/lib/boot2docker/certs

Copy the ca.crt to the folders /var/lib/boot2docker/certs/ and /etc/docker/certs.d/

Restart docker

docker-machine restart default

Mac OS

Login to the vsphere UI, navigate to the Image Registry option under Configure tab for the cluster and click on Download SSL Root Certificate to save the registry CA certificate to local and save it as ca.crt.

Get the Harbor cert and save it to the following locations:

/etc/docker/certs.d/<harbor_ip>/ca.crt

~/.docker/certs.d/<harbor_ip>/ca.crt

Proxy configuration

Linux

Add the proxy IP and port to the proxy config file at location /etc/systemd/system/docker.service.d/proxy.conf as follows:

[Service]
Environment="HTTP_PROXY=http://<proxy_ip>:<proxy_port"
Environment="HTTPS_PROXY=http://<proxy_ip>:<proxy_port"

Export the proxy variables in the Terminal where you need proxy access:

export HTTP_PROXY=http://<proxy_ip>:<proxy_port
export HTTPS_PROXY=http://<proxy_ip>:<proxy_port

Restart docker

sudo systemctl daemon-reload
sudo systemctl restart docker

In case you hit the permission denied issue with docker login you may need to execute the command:

sudo chmod 666 /var/run/docker.sock

Windows 10

Add the proxy IP address and port to the proxies in the docker config file at location ~/.docker/config.json as follows:

{
"auths": {},
"credsStore": "desktop",
"proxies": {
"default": {
"httpProxy": "http://<proxy_ip>:<proxy_port>",
"httpsProxy": "http://<proxy_ip>:<proxy_port>"
}
},
"experimental": "enabled",
"stackOrchestrator": "swarm"
}

Add the following values to the system environment variables as well:

HTTP_PROXY = "http://<proxy_ip>:<proxy_port>"
HTTPS_PROXY = "http://<proxy_ip>:<proxy_port>"

Add the gateway VM IP to the manual proxy configuration for docker as well

Restart docker

Windows 7

Add the proxy IP address and port to the proxies in the docker config file at location ~/.docker/config.json as follows:

{
"auths": {},
"credsStore": "desktop",
"proxies": {
"default": {
"httpProxy": "http://<proxy_ip>:<proxy_port>",
"httpsProxy": "http://<proxy_ip>:<proxy_port>"
}
},
"experimental": "enabled",
"stackOrchestrator": "swarm"
}

Add the gateway VM IP to the manual proxy configuration for docker as well

docker-machine ssh default
sudo -s

Add the following to the file /var/lib/boot2docker/profile:

export HTTP_PROXY=http://<proxy_ip>:<proxy_port>
export HTTPS_PROXY=http://<proxy_ip>:<proxy_port>

Restart docker

docker-machine restart default

Mac OS

Add the proxy IP and port to the list of proxies in the docker config file at location ~/.docker/config.json as follows:

{
"proxies" : {
"default" : {
"httpsProxy" : "http://<proxy_ip>:<proxy_port>",
"httpProxy" : "http://<proxy_ip>:<proxy_port>"
}
},
"credsStore" : "osxkeychain",
"stackOrchestrator" : "swarm"

Add the proxy IP and port to the manual proxy configuration for docker as well

Restart docker

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
English

Attachments

Additional Resources

KB
•
End Of General Availability of the Free vSphere Hypervisor (ESXi 7.x and 8.x) (2107518)

KB
•
ホストをクラスタに移動するときに、「信頼できるインフラストラクチャ ホストの未構成アラーム」というアラームが発生する (77234)

KB
•
ATTO atto_cim ESXi ホスト CIM プロバイダの概要 (78129)

Results 1-3 of 3

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

VMware vCenter Server

Related Versions:

VMware vCenter Server 7.0.x

Take Our Survey

Support Assistant