Add TLS certificate generation, management utils

cmd/cli/commands/install-runner.go

@@ -143,7 +143,9 @@ func ensureStandaloneRunnerAvailable(ctx context.Context, printer standalone.Sta
 		port = standalone.DefaultControllerPortCloud
 		environment = "cloud"
 	}
-	if err := standalone.CreateControllerContainer(ctx, dockerClient, port, host, environment, false, gpu, "", modelStorageVolume, printer, engineKind, debug, false, ""); err != nil {
+	// TLS is disabled by default for auto-installation
+	tlsOpts := standalone.TLSOptions{Enabled: false}
+	if err := standalone.CreateControllerContainer(ctx, dockerClient, port, host, environment, false, gpu, "", modelStorageVolume, printer, engineKind, debug, false, "", tlsOpts); err != nil {
 		return nil, fmt.Errorf("unable to initialize standalone model runner container: %w", err)
 	}
 
@@ -225,6 +227,10 @@ type runnerOptions struct {
 	pullImage       bool
 	pruneContainers bool
 	proxyCert       string
+	tls             bool
+	tlsPort         uint16
+	tlsCert         string
+	tlsKey          string
 }
 
 // runInstallOrStart is shared logic for install-runner and start-runner commands
@@ -337,8 +343,17 @@ func runInstallOrStart(cmd *cobra.Command, opts runnerOptions, debug bool) error
 	if err != nil {
 		return fmt.Errorf("unable to initialize standalone model storage: %w", err)
 	}
+
+	// Build TLS options
+	tlsOpts := standalone.TLSOptions{
+		Enabled:  opts.tls,
+		Port:     opts.tlsPort,
+		CertPath: opts.tlsCert,
+		KeyPath:  opts.tlsKey,
+	}
+
 	// Create the model runner container.
-	if err := standalone.CreateControllerContainer(cmd.Context(), dockerClient, port, opts.host, environment, opts.doNotTrack, gpu, opts.backend, modelStorageVolume, asPrinter(cmd), engineKind, debug, vllmOnWSL, opts.proxyCert); err != nil {
+	if err := standalone.CreateControllerContainer(cmd.Context(), dockerClient, port, opts.host, environment, opts.doNotTrack, gpu, opts.backend, modelStorageVolume, asPrinter(cmd), engineKind, debug, vllmOnWSL, opts.proxyCert, tlsOpts); err != nil {
 		return fmt.Errorf("unable to initialize standalone model runner container: %w", err)
 	}
 
@@ -354,6 +369,10 @@ func newInstallRunner() *cobra.Command {
 	var doNotTrack bool
 	var debug bool
 	var proxyCert string
+	var tlsEnabled bool
+	var tlsPort uint16
+	var tlsCert string
+	var tlsKey string
 	c := &cobra.Command{
 		Use:   "install-runner",
 		Short: "Install Docker Model Runner (Docker Engine only)",
@@ -367,6 +386,10 @@ func newInstallRunner() *cobra.Command {
 				pullImage:       true,
 				pruneContainers: false,
 				proxyCert:       proxyCert,
+				tls:             tlsEnabled,
+				tlsPort:         tlsPort,
+				tlsCert:         tlsCert,
+				tlsKey:          tlsKey,
 			}, debug)
 		},
 		ValidArgsFunction: completion.NoComplete,
@@ -379,6 +402,10 @@ func newInstallRunner() *cobra.Command {
 		DoNotTrack: &doNotTrack,
 		Debug:      &debug,
 		ProxyCert:  &proxyCert,
+		TLS:        &tlsEnabled,
+		TLSPort:    &tlsPort,
+		TLSCert:    &tlsCert,
+		TLSKey:     &tlsKey,
 	})
 	return c
 }

cmd/cli/commands/reinstall-runner.go

@@ -13,6 +13,10 @@ func newReinstallRunner() *cobra.Command {
 	var doNotTrack bool
 	var debug bool
 	var proxyCert string
+	var tlsEnabled bool
+	var tlsPort uint16
+	var tlsCert string
+	var tlsKey string
 	c := &cobra.Command{
 		Use:   "reinstall-runner",
 		Short: "Reinstall Docker Model Runner (Docker Engine only)",
@@ -26,6 +30,10 @@ func newReinstallRunner() *cobra.Command {
 				pullImage:       true,
 				pruneContainers: true,
 				proxyCert:       proxyCert,
+				tls:             tlsEnabled,
+				tlsPort:         tlsPort,
+				tlsCert:         tlsCert,
+				tlsKey:          tlsKey,
 			}, debug)
 		},
 		ValidArgsFunction: completion.NoComplete,
@@ -38,6 +46,10 @@ func newReinstallRunner() *cobra.Command {
 		DoNotTrack: &doNotTrack,
 		Debug:      &debug,
 		ProxyCert:  &proxyCert,
+		TLS:        &tlsEnabled,
+		TLSPort:    &tlsPort,
+		TLSCert:    &tlsCert,
+		TLSKey:     &tlsKey,
 	})
 	return c
 }

cmd/cli/commands/start-runner.go

@@ -7,33 +7,48 @@ import (
 
 func newStartRunner() *cobra.Command {
 	var port uint16
+	var host string
 	var gpuMode string
 	var backend string
 	var doNotTrack bool
 	var debug bool
 	var proxyCert string
+	var tlsEnabled bool
+	var tlsPort uint16
+	var tlsCert string
+	var tlsKey string
 	c := &cobra.Command{
 		Use:   "start-runner",
 		Short: "Start Docker Model Runner (Docker Engine only)",
 		RunE: func(cmd *cobra.Command, args []string) error {
 			return runInstallOrStart(cmd, runnerOptions{
 				port:       port,
+				host:       host,
 				gpuMode:    gpuMode,
 				backend:    backend,
 				doNotTrack: doNotTrack,
 				pullImage:  false,
 				proxyCert:  proxyCert,
+				tls:        tlsEnabled,
+				tlsPort:    tlsPort,
+				tlsCert:    tlsCert,
+				tlsKey:     tlsKey,
 			}, debug)
 		},
 		ValidArgsFunction: completion.NoComplete,
 	}
 	addRunnerFlags(c, runnerFlagOptions{
 		Port:       &port,
+		Host:       &host,
 		GpuMode:    &gpuMode,
 		Backend:    &backend,
 		DoNotTrack: &doNotTrack,
 		Debug:      &debug,
 		ProxyCert:  &proxyCert,
+		TLS:        &tlsEnabled,
+		TLSPort:    &tlsPort,
+		TLSCert:    &tlsCert,
+		TLSKey:     &tlsKey,
 	})
 	return c
 }

cmd/cli/commands/utils.go

@@ -195,6 +195,10 @@ type runnerFlagOptions struct {
 	DoNotTrack *bool
 	Debug      *bool
 	ProxyCert  *string
+	TLS        *bool
+	TLSPort    *uint16
+	TLSCert    *string
+	TLSKey     *string
 }
 
 // addRunnerFlags adds common runner flags to a command
@@ -221,6 +225,19 @@ func addRunnerFlags(cmd *cobra.Command, opts runnerFlagOptions) {
 	if opts.ProxyCert != nil {
 		cmd.Flags().StringVar(opts.ProxyCert, "proxy-cert", "", "Path to a CA certificate file for proxy SSL inspection")
 	}
+	if opts.TLS != nil {
+		cmd.Flags().BoolVar(opts.TLS, "tls", false, "Enable TLS/HTTPS for Docker Model Runner API")
+	}
+	if opts.TLSPort != nil {
+		cmd.Flags().Uint16Var(opts.TLSPort, "tls-port", 0,
+			"TLS port for Docker Model Runner (default: 12444 for Docker Engine, 12445 for Cloud mode)")
+	}
+	if opts.TLSCert != nil {
+		cmd.Flags().StringVar(opts.TLSCert, "tls-cert", "", "Path to TLS certificate file (auto-generated if not provided)")
+	}
+	if opts.TLSKey != nil {
+		cmd.Flags().StringVar(opts.TLSKey, "tls-key", "", "Path to TLS private key file (auto-generated if not provided)")
+	}
 }
 
 // newTable creates a new table with Docker CLI-style formatting: