docker: add a note about TLS

[AkihiroSuda]

TCP connection without TLS is completely insecure and can easily result
in container breakout.

Signed-off-by: Akihiro Suda akihiro.suda.cz@hco.ntt.co.jp

[AkihiroSuda]

@tianon @justincormack @thaJeztah PTAL

[justincormack]

I think we should remove this default from the dind containers.

[tianon]

@justincormack if we remove the default, the container will default to unix-socket only, which makes for a pretty irritating user experience from a container 😞 Any ideas for how to resolve that?

[AkihiroSuda]

@tianon

Any ideas for how to resolve that?

My suggestion is to let dind create TLS files on start up
docker-library/docker#164

$ docker run -d --privileged --name some-docker \
  -e DIND_TLS_SAN=DNS:docker,DNS:localhost docker:dind
$ docker cp some-docker:/certs/for-client ./certs-for-client
$ docker run --rm --link some-docker:docker -v $(pwd)/certs-for-client:/root/.docker \
  -e DOCKER_HOST=tcp://docker:2376 docker info

[AkihiroSuda]

Can we get this merged?