Encryption at rest

  • Swarm data is always encrypted

  • A Swarm cluster can be "locked"

  • When a cluster is "locked", the encryption key is protected with a passphrase

  • Starting or restarting a locked manager requires the passphrase

  • This protects against:

    • theft (stealing a physical machine, a disk, a backup tape...)

    • unauthorized access (to e.g. a remote or virtual volume)

    • some vulnerabilities (like path traversal)

Locking a Swarm cluster

  • This is achieved through the docker swarm update command
  • Lock our cluster:
    docker swarm update --autolock=true

This will display the unlock key. Copy-paste it somewhere safe.

Locked state

  • If we restart a manager, it will now be locked
  • Restart the local Engine:
    sudo systemctl restart docker

Note: if you are doing the workshop on your own, using nodes that you provisioned yourself or with Play-With-Docker, you might have to use a different method to restart the Engine.

Checking that our node is locked

  • Manager commands (requiring access to crypted data) will fail

  • Other commands are OK

  • Try a few basic commands:
    docker ps
    docker run alpine echo ♥
    docker node ls

(The last command should fail, and it will tell you how to unlock this node.)

Checking node state in scripts

  • The state of the node shows up in the output of docker info
  • Check the output of docker info:

    docker info
  • Can't see it? Too verbose? Grep to the rescue!

    docker info | grep ^Swarm

Unlocking a node

  • You will need the secret token that we obtained when enabling auto-lock earlier
  • Unlock the node:

    docker swarm unlock
  • Copy-paste the secret token that we got earlier

  • Check that manager commands now work correctly:

    docker node ls

Managing the secret key

  • If the key is compromised, you can change it and re-encrypt with a new key:

    docker swarm unlock-key --rotate
  • If you lost the key, you can get it as long as you have at least one unlocked node:

    docker swarm unlock-key -q

Note: if you rotate the key while some nodes are locked, without saving the previous key, those nodes won't be able to rejoin.

Note: if somebody steals both your disks and your key, .strike[you're doomed! Doooooomed!]
you can block the compromised node with docker node demote and docker node rm.

Unlocking the cluster permanently

  • If you want to remove the secret key, disable auto-lock
  • Permanently unlock the cluster:
    docker swarm update --autolock=false

Note: if some nodes are in locked state at that moment (or if they are offline/restarting while you disabled autolock), they still need the previous unlock key to get back online.

For more information about locking, you can check the upcoming documentation.