Invalid tls settings in the daemon.json settings example

[jasonbivins]

File: ee/ucp/admin/configure/join-nodes/join-windows-nodes-to-cluster.md

This example in this section includes a linux only option- tls:true
https://docs.docker.com/ee/ucp/admin/configure/join-nodes/#compatibility-with-daemonjson

Please remove debug:true from the example as well.

Official list of windows daemon.json options here:
https://docs.microsoft.com/en-us/virtualization/windowscontainers/manage-docker/configure-docker-daemon

[thaJeztah]

This example in this section includes a linux only option- tls:true

Curious; does the tls: true option produce an error on Windows? Afaics, the flag (and configuration option) should be present both on Windows and Linux; https://github.com/moby/moby/blob/93d994e29c9cc8d81f1b0477e28d705fa7e2cd72/cmd/dockerd/options.go#L59

Official list of windows daemon.json options here:

That list is taken from our documentation; https://docs.docker.com/engine/reference/commandline/dockerd/#/windows-configuration-file

I see tls is not listed there, but want to be sure it's not supported, or just an omission in the documentation.

[jasonbivins]

on Server - with just tls:true in the daemon it works, but fails if you add the cert paths

Desktop wont even let you apply tls as a setting, it says tls is an invalid option

[thaJeztah]

on Server - with just tls:true in the daemon it works, but fails if you add the cert paths

What's the error message you get?

Desktop wont even let you apply tls as a setting, it says tls is an invalid option

That could be a bug in the Docker Desktop validation (it's been out of sync with reality in a couple of occasions)

[jasonbivins]

Here's the error it shows in the logs - I've got an open escalation for this part:

fatal: unable to configure the Docker daemon with file C:\ProgramData\docker\config\daemon.json: the following directives are specified both as a flag and in the configuration file: tlscacert: (from flag: C:\ProgramData\docker\daemoncerts\ca.pem, from file: C:\ProgramData\docker\daemoncerts\ca.pem), tlscert: (from flag: C:\ProgramData\docker\daemoncerts\cert.pem, from file: C:\ProgramData\docker\daemoncerts\cert.pem), tlskey: (from flag: C:\ProgramData\docker\daemoncerts\key.pem, from file: C:\ProgramData\docker\daemoncerts\key.pem)

[thaJeztah]

That's on desktop or Windows Server?

The error message indicates that the daemon is started with the --tls-ca-cert flags set, in which case you cannot specify the same option in the daemon.json configuration file

[jasonbivins]

This is on Server
dug into this a bit deeper with the seg group this morning - we should probably just remove this section from the UCP docs I can write a kb for the error message and resolution . https://docs.docker.com/ee/ucp/admin/configure/join-nodes/#compatibility-with-daemonjson

the windows UCP prep script registers the daemon with the path to the certs, which makes the cert path settings in the daemon.json invalid unless you manually unregister them.

Non UCP joined daemon:

UCP joined daemon

[thaJeztah]

🤔 could we make it write a default daemon.json instead?

[thaJeztah]

(anecdotally daemon.json was originally developed by request from the UCP team)

[jasonbivins]

I would prefer to keep it all in the daemon - it would be much simpler to keep everything in one place instead of the current windows hodgepodge of env variables and service properties

[usha-mandya]

Thanks for your feedback. Docker Enterprise docs are now part of Mirantis. You can take a look at the Docker Enterprise documentation at https://docs.mirantis.com/docker-enterprise/.

Let me close this issue here for that reason. Feel free to continue the conversation after I close.