docker-machine使用vSphere驱动

Docker Machine can create a small Linux guest on vSphere and configure the Docker daemon for remote use. This walkthrough keeps the infrastructure example reproducible while separating credentials from the article.

Prerequisites

Install Docker Machine and a compatible vSphere driver on the operator workstation. The example assumes that a template or boot image is already available and that the automation account can create and power on a virtual machine in the target folder.

Load the password from a protected environment file, an interactive prompt, or a secret manager before running the commands. Do not put the value in shell history or source control.

export VSPHERE_SERVER="vcenter.example.test"
export VSPHERE_USERNAME="automation@example.test"
export VSPHERE_NETWORK="PG-LAB"
export VSPHERE_DATASTORE="datastore-lab"
export VSPHERE_DATACENTER="LAB_DC"
export VSPHERE_FOLDER="folder-lab"
export VSPHERE_CLUSTER="cluster-lab"

: "${VSPHERE_PASSWORD:?Load VSPHERE_PASSWORD from a protected source}"

Create the machine

Keep configuration in variables so the command remains readable and can be reused in CI without editing the article.

docker-machine create \
  --driver vmwarevsphere \
  --vmwarevsphere-vcenter "$VSPHERE_SERVER" \
  --vmwarevsphere-username "$VSPHERE_USERNAME" \
  --vmwarevsphere-password "$VSPHERE_PASSWORD" \
  --vmwarevsphere-network "$VSPHERE_NETWORK" \
  --vmwarevsphere-datastore "$VSPHERE_DATASTORE" \
  --vmwarevsphere-datacenter "$VSPHERE_DATACENTER" \
  --vmwarevsphere-folder "$VSPHERE_FOLDER" \
  --vmwarevsphere-hostsystem "$VSPHERE_CLUSTER" \
  docker-lab

Inspect the generated connection settings and point the local Docker client at the new daemon:

docker-machine ls
eval "$(docker-machine env docker-lab)"
docker info

In this synthetic lab, 192.0.2.21 is the guest management address and 192.0.2.10 represents the management endpoint. Both addresses are reserved for documentation.

Certificate troubleshooting

A certificate error usually means that the certificate name does not match the name used by the client, or that the issuing certificate authority is not trusted. Fix the trust chain instead of disabling verification.

Store operator-specific files below /home/operator and keep them out of the repository:

install -d -m 700 /home/operator/.docker/machine/certs
scp operator@192.0.2.21:/etc/docker/ca.pem \
  /home/operator/.docker/machine/certs/docker-lab-ca.pem
chmod 600 /home/operator/.docker/machine/certs/docker-lab-ca.pem

If the certificate was issued for vcenter.example.test, connect with that name and verify DNS resolution before retrying. Regenerating certificates is preferable to accepting an unexpected certificate.

Remove the lab guest

docker-machine rm docker-lab
unset VSPHERE_PASSWORD

The final unset reduces accidental reuse in later shell commands; it does not replace normal secret rotation and access controls.