Enable Docker Remote API on Docker Machine on Mac OS X

Docker daemon provides a Remote REST API. This API is used by the Client to communicate with the engine. This API can be also be invoked by by other tools, such as curl or Chrome Postman REST Client.

If you are creating Docker daemons using Docker Machine on OSX Mavericks, then getting this API to work is a bit tricky. This blog will explain how to enable Docker Remote API on Docker Machines created on Mac OS X.

Connecting to the secure Docker port using curl gives the command as:

$ curl https://$HOST:2376/images/json \
  --cert ~/.docker/cert.pem \
  --key ~/.docker/key.pem \
  --cacert ~/.docker/ca.pem

Couple of issues with this command:

  • This command does not even work for Docker Machine since the certificates for each Machine are stored in .docker/machine/machines/<machine-name> directory.
  • Even if this command is modified to match that path:
    curl --cert $DOCKER_CERT_PATH/cert.pem --key $DOCKER_CERT_PATH/key.pem --cacert $DOCKER_CERT_PATH/ca.pem

    It still gives the following error:

    curl: (58) SSL: Can't load the certificate "/Users/arungupta/.docker/machine/machines/couchbase/cert.pem" and its private key: OSStatus -25299

    The culprit for this is an updated curl utility for OSX Mavericks users. In summary, the new version of CURL uses Apple’s Secure Transport API instead of the OpenSSL API. This means the certificates need to be in P12 format.

Lets fix this!

  • Go to the directory where certificates for your Machine are stored. In my case, this is .docker/machine/machines/couchbase directory.
  • Generate *.p12 format for the certificate:
    openssl pkcs12 -export \
    -inkey key.pem \
    -in cert.pem \
    -CAfile ca.pem \
    -chain \
    -name client-side \
    -out cert.p12 \
    -password pass:mypass

    More details here.

  • Now invoke the REST API as:
    curl --cert $DOCKER_CERT_PATH/cert.p12 --pass mypass --key $DOCKER_CERT_PATH/key.pem --cacert $DOCKER_CERT_PATH/ca.pem

    Notice, --cert now points to the generated p12 certificate and certificate password is specified sing --pass.

    This will return the result as:


    OK, now that makes sense!

  • Lets try to start Couchbase server as:
    ~ > docker run -d -p 8091-8093:8091-8093 -p 11210:11210 arungupta/couchbase

    And invoke another REST API to view more details about this container:

    ~ > curl --cert $DOCKER_CERT_PATH/cert2.p12 --pass mypass --key $DOCKER_CERT_PATH/key.pem --cacert $DOCKER_CERT_PATH/ca.pem
    [{"Id":"42d1414883affd0fbb272cb1378c2f6b5118acf3ed5cb60cbecdc42f95602e3e","Names":["/admiring_pike"],"Image":"arungupta/couchbase","ImageID":"sha256:d38beda529d3274636d6cb1c9000afe4f00fbdcfa544140d6cc0f5d7f5b8434a","Command":"/ /opt/couchbase/","Created":1454850194,"Ports":[{"IP":"","PrivatePort":8092,"PublicPort":8092,"Type":"tcp"},{"PrivatePort":11207,"Type":"tcp"},{"IP":"","PrivatePort":11210,"PublicPort":11210,"Type":"tcp"},{"PrivatePort":18092,"Type":"tcp"},{"PrivatePort":18091,"Type":"tcp"},{"IP":"","PrivatePort":8093,"PublicPort":8093,"Type":"tcp"},{"IP":"","PrivatePort":8091,"PublicPort":8091,"Type":"tcp"},{"PrivatePort":11211,"Type":"tcp"}],"Labels":{},"Status":"Up 2 seconds","HostConfig":{"NetworkMode":"default"},"NetworkSettings":{"Networks":{"bridge":{"IPAMConfig":null,"Links":null,"Aliases":null,"NetworkID":"","EndpointID":"6feaf4c1c70feaf0ba240ce55fb58ce83ebb84c8098bef9171998e84f607fa0b","Gateway":"","IPAddress":"","IPPrefixLen":16,"IPv6Gateway":"","GlobalIPv6Address":"","GlobalIPv6PrefixLen":0,"MacAddress":"02:42:ac:11:00:02"}}}}]

Read through the complete API and go crazy now!

Arun Gupta

Arun is a technology enthusiast, avid runner, author of a best-selling book, globe trotter, a community guy, Java Champion, JavaOne Rockstar, JUG Leader, Minecraft Modder, Devoxx4Kids-er, and a Red Hatter.
Notify of

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Inline Feedbacks
View all comments
Back to top button