Docker和加密密钥

是的,您可以与源二进制文件分开运行tezos-signer,然后将其连接到在Docker容器中运行的tezos-node.这就是您的方法.

在tezos-signer服务器上,从下载tezos-signer二进制文件的目录中运行以下3条命令:

1. tezos-signergen键爱丽丝
2. cat〜/.tezos-signer/public_key_hashs

这将输出如下内容: [{"name":" alice"," value":"tz1abc ..."}]

复制上面看起来像"tz1abc ..."的公钥哈希.

3. tezos-signer启动套接字签名器-home-ip

其中 home-ip是运行tezos-signer的服务器的IP地址.默认情况下,它使用端口7732

注意::以上命令将提示您输入加密密钥的密码,以启动签名者守护进程. 您需要保持守护进程的运行状态,远程签名人才能正常工作.因此建议将其作为后台服务运行.我建议使用tmux 来实现.

现在在运行docker的服务器上,运行以下命令:

1)./mainnet.sh客户端导入密钥alicetcp://home-ip:7732/tz1abc ...

其中

home-ip与上面第3点中使用的相同

tz1abc ...与上面第2点中使用的公钥哈希相同

以上命令将从唱歌服务器中导入公钥,但私钥仍保留在签名服务器上.如果您检查存储在Docker容器中的私钥文件,您会发现该值将被存储而不是私钥 [{"名称":" alice", " value":"tcp://home-ip:7732/tz1abc ...."}]

在容器中运行的贝克将通过联系tezos-singer恶魔必须处于运行状态的签名服务器,自动使用上述值从签名服务器获取交易签名.

信息:要检查存储在Docker容器中的私钥,请使用以下过程:

//要在容器中进入外壳模式

1. dockerexec -itmainnet_node_1/bin/sh

//要进入在Docker容器中维护密钥的目录

2. cd/var/run/tezos/client/

3. 猫的秘密密钥

Yes you can run tezos-signer separately from source binary and then let it connect to tezos-node running in docker container. This is how you can do it.

On tezos-signer server run following 3 commands from directory where tezos-signer binary is downloaded:

1. tezos-signer gen keys alice
2. cat ~/.tezos-signer/public_key_hashs

This will output something like this: [ { "name": "alice", "value": "tz1abc..." } ]

Copy your public key hash which looks like "tz1abc..." above.

3. tezos-signer launch socket signer -a home-ip

where home-ip is IP address of your server where tezos-signer is running. By default it uses port 7732

NOTE: Above command will prompt for password for your encrypted key, to start the signer deamon. You need to keep your deamon running in order for remote signer to work. So it is recommended to run it as background service. I recommend using tmux to do that.

Now on server where your docker is running, run following commands:

1) ./mainnet.sh client import secret key alice tcp://home-ip:7732/tz1abc...

where

home-ip is same as used in point 3 above

tz1abc... is same public key hash used in point 2 above

Above command will import the public key from singing server, but private key still remains on signing server. If you check the private keys file stored in docker container you'll find instead of private key this value would be store [{ "name": "alice", "value": "tcp://home-ip:7732/tz1abc...." }]

Baker running in container will automatically get the transaction signed from signing server using the above value by contacting the signing server where tezos-singer deamon must be in running state.

INFO: To check private keys stored in docker container use below process:

// To enter the shell mode in container

1. docker exec -it mainnet_node_1 /bin/sh

// To enter the directory where keys are maintained in docker container

2. cd /var/run/tezos/client/

3. cat secret_keys