title: How to secure docker client connection by default?
body: <p>I'm using https to protect the docker daemon socket. Followed all the steps as mentioned <a href="https://docs.docker.com/engine/security/protect-access/#use-tls-https-to-protect-the-docker-daemon-socket" rel="nofollow noreferrer">here</a>. The environment variables are set as below,</p>
  <ul>
  <li>DOCKER_TLS_VERIFY=1</li>
  <li>DOCKER_CERT_PATH=~/.docker  == All my client, ca &amp; server certificates + keys exist here</li>
  <li>DOCKER_HOST=tcp://$HOST:2376</li>
  </ul>
  <p>The below command works (when I pass ca, client certificate &amp; key):</p>
  <pre><code>docker --tlsverify --tlscacert=~/.docker/ca.pem --tlscert=~/.docker/client-cert.pem --tlskey=~/.docker/client-key.pem -H=$HOST:2376 ps
  </code></pre>
  <p>According to <a href="https://docs.docker.com/engine/security/protect-access/#secure-by-default" rel="nofollow noreferrer">Docker documentation</a> , I can secure docker client connections by default and do not need to pass certificates every time but the command &quot;docker ps&quot; , doesn't work for me. It always expects client certificate to be passed.</p>
  <p>I also tried executing the below,</p>
  <pre><code>docker-compose --tlsverify --tlscacert=~/.docker/ca.pem --tlscert=~/.docker/client-cert.pem --tlskey=~/.docker/client-key.pem -H=$HOST:2376  up
  
  ERROR: TLS configuration is invalid - make sure your DOCKER_TLS_VERIFY and DOCKER_CERT_PATH are set correctly
  </code></pre>
  <p>How can I secure the docker client connections by default ? I just want to execute like &quot;docker ps&quot; without passing client certificate every time since it already exists in ~/.docker</p>
  <p>I have also referred a similar question <a href="https://stackoverflow.com/questions/38286564/docker-tls-verify-docker-host-and-docker-cert-path-on-ubuntu">here</a></p>