From ad26e7cd3a32acf02d0011b5da961e5a3ebfeb34 Mon Sep 17 00:00:00 2001
From: Nima HeydariNasab <nima.heydari79@yahoo.com>
Date: Fri, 24 Mar 2023 01:45:30 +0330
Subject: [PATCH 1/9] Get ExposedPorts from Config if it does not exist in
 ContainerConfig

---
 docker_challenges/__init__.py | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/docker_challenges/__init__.py b/docker_challenges/__init__.py
index 190ef35..91a7f1d 100644
--- a/docker_challenges/__init__.py
+++ b/docker_challenges/__init__.py
@@ -282,8 +282,11 @@ def get_unavailable_ports(docker):
 
 def get_required_ports(docker, image):
     r = do_request(docker, f'/images/{image}/json?all=1')
-    result = r.json()['ContainerConfig']['ExposedPorts'].keys()
-    return result
+    result = r.json()
+    ports = (result['ContainerConfig']['ExposedPorts']\
+        if 'ExposedPorts' in result['ContainerConfig']\
+        else result['Config']['ExposedPorts']).keys()
+    return ports
 
 
 def create_container(docker, image, team, portbl):

From 993227f0b8d7245e6c4d6139bf16464210c9f550 Mon Sep 17 00:00:00 2001
From: Nima HeydariNasab <nima.heydari79@yahoo.com>
Date: Fri, 24 Mar 2023 23:16:59 +0330
Subject: [PATCH 2/9] Add feature to specify which ports to publish per
 challenge image

---
 docker_challenges/__init__.py        | 27 ++++++++++++++++++++++++++-
 docker_challenges/assets/create.html |  6 ++++++
 docker_challenges/assets/create.js   |  5 +++++
 docker_challenges/assets/update.html |  7 +++++++
 docker_challenges/assets/update.js   |  6 ++++++
 5 files changed, 50 insertions(+), 1 deletion(-)

diff --git a/docker_challenges/__init__.py b/docker_challenges/__init__.py
index 91a7f1d..ccf209c 100644
--- a/docker_challenges/__init__.py
+++ b/docker_challenges/__init__.py
@@ -315,7 +315,8 @@ def create_container(docker, image, team, portbl):
             return []
     host = docker.hostname
     URL_TEMPLATE = '%s://%s' % (prefix, host)
-    needed_ports = get_required_ports(docker, image)
+    challenge = DockerChallenge.query.filter_by(docker_image=image).first()
+    needed_ports = challenge.ports.split(',') if challenge.ports else get_required_ports(docker, image)
     team = hashlib.md5(team.encode("utf-8")).hexdigest()[:10]
     container_name = "%s_%s" % (image.split(':')[1], team)
     assigned_ports = dict()
@@ -425,6 +426,7 @@ def read(challenge):
             'name': challenge.name,
             'value': challenge.value,
             'docker_image': challenge.docker_image,
+            'ports': challenge.ports,
             'description': challenge.description,
             'category': challenge.category,
             'state': challenge.state,
@@ -539,6 +541,7 @@ class DockerChallenge(Challenges):
     __mapper_args__ = {'polymorphic_identity': 'docker'}
     id = db.Column(None, db.ForeignKey('challenges.id'), primary_key=True)
     docker_image = db.Column(db.String(128), index=True)
+    ports = db.Column(db.String(128), nullable=True)
 
 
 # API
@@ -675,6 +678,27 @@ def get(self):
                    }, 400
 
 
+docker_ports_namespace = Namespace("docker", description='Endpoint to retrieve docker image exposed ports')
+
+
+@docker_ports_namespace.route("", methods=['POST', 'GET'])
+class DockerPortsAPI(Resource):
+    """
+    This is for creating Docker Challenges. The purpose of this API is to populate the Docker Image exposed ports Select form
+    object in the Challenge Creation Screen.
+    """
+
+    @admins_only
+    def get(self):
+        image = request.args.get('image')
+        docker = DockerConfig.query.filter_by(id=1).first()
+        exposed_ports = list(get_required_ports(docker, image))
+        return {
+            'success': True,
+            'data': exposed_ports
+        }
+
+
 def load(app):
     app.db.create_all()
     CHALLENGE_CLASSES['docker'] = DockerChallengeType
@@ -682,6 +706,7 @@ def load(app):
     define_docker_admin(app)
     define_docker_status(app)
     CTFd_API_v1.add_namespace(docker_namespace, '/docker')
+    CTFd_API_v1.add_namespace(docker_ports_namespace, '/docker_ports')
     CTFd_API_v1.add_namespace(container_namespace, '/container')
     CTFd_API_v1.add_namespace(active_docker_namespace, '/docker_status')
     CTFd_API_v1.add_namespace(kill_container, '/nuke')
diff --git a/docker_challenges/assets/create.html b/docker_challenges/assets/create.html
index 6106b5e..dd9d493 100644
--- a/docker_challenges/assets/create.html
+++ b/docker_challenges/assets/create.html
@@ -15,6 +15,12 @@
     </label>
     <select id="dockerimage_select" name="docker_image" class="form-control" required></select>
 </div>
+<div class="form-group">
+    <label for="ports" id="ports_label"><span id="ports_text">Published Ports, Separated With Comma:</span>
+        <i class="far fa-question-circle text-muted cursor-help" data-toggle="tooltip" data-placement="right" title="Leave empty to publish all exposed ports"></i>
+    </label>
+    <input type="text" class="form-control" name="ports">
+</div>
 {% endblock %}
 {% block type %}
 <input type="hidden" name="type" value="docker" id="chaltype">
diff --git a/docker_challenges/assets/create.js b/docker_challenges/assets/create.js
index 51ae118..a318f4f 100644
--- a/docker_challenges/assets/create.js
+++ b/docker_challenges/assets/create.js
@@ -22,5 +22,10 @@ CTFd.plugin.run((_CTFd) => {
             }
         });
     });
+        $("#docker_image").on("change", function() {
+            $.getJSON("/api/v1/docker_ports?image=" + this.value, function(result) {
+                $("#ports_text").text("Published Ports, Separated With Comma (Allowed Values: " + result["data"].join(", ") + "):");
+            });
+        });
 });
 });
\ No newline at end of file
diff --git a/docker_challenges/assets/update.html b/docker_challenges/assets/update.html
index 878ac05..444a697 100644
--- a/docker_challenges/assets/update.html
+++ b/docker_challenges/assets/update.html
@@ -13,9 +13,16 @@
     </label>
     <select id="dockerimage_select" name="docker_image" class="form-control" required></select>
 </div>
+<div class="form-group">
+    <label for="ports" id="ports_label"><span id="ports_text">Published Ports, Separated With Comma:</span>
+        <i id="ports_tooltip" class="far fa-question-circle text-muted cursor-help" data-toggle="tooltip" data-placement="right" title="Leave empty to publish all exposed ports"></i>
+    </label>
+    <input id="docker_image_ports" type="text" class="form-control" name="ports">
+</div>
 {% endblock %}
 {% block footer %}
 <script>
 var DOCKER_IMAGE = '{{ challenge.docker_image }}';
+var DOCKER_IMAGE_PORTS = '{{ challenge.ports }}';
 </script>
 {% endblock %}
\ No newline at end of file
diff --git a/docker_challenges/assets/update.js b/docker_challenges/assets/update.js
index 524afb4..ac9a86a 100644
--- a/docker_challenges/assets/update.js
+++ b/docker_challenges/assets/update.js
@@ -7,6 +7,12 @@ CTFd.plugin.run((_CTFd) => {
                 $("#dockerimage_select").append($("<option />").val(item.name).text(item.name));
             });
             $("#dockerimage_select").val(DOCKER_IMAGE).change();
+            $("#docker_image_ports").attr("value", DOCKER_IMAGE_PORTS);
+        });
+        $("#docker_image").on("change", function() {
+            $.getJSON("/api/v1/docker_ports?image=" + this.value, function(result) {
+                $("#ports_text").text("Published Ports, Separated With Comma (Allowed Values: " + result["data"].join(", ") + "):");
+            });
         });
     });
 });
\ No newline at end of file

From 313e6737ab481bf68cc8f7d8eb490b2654c603bb Mon Sep 17 00:00:00 2001
From: Nima HeydariNasab <nima.heydari79@yahoo.com>
Date: Fri, 24 Mar 2023 23:20:57 +0330
Subject: [PATCH 3/9] Remove unused imports

---
 docker_challenges/__init__.py | 26 +++++---------------------
 1 file changed, 5 insertions(+), 21 deletions(-)

diff --git a/docker_challenges/__init__.py b/docker_challenges/__init__.py
index ccf209c..fed6705 100644
--- a/docker_challenges/__init__.py
+++ b/docker_challenges/__init__.py
@@ -1,39 +1,25 @@
 import traceback
 
-from CTFd.plugins.challenges import BaseChallenge, CHALLENGE_CLASSES, get_chal_class
+from CTFd.plugins.challenges import BaseChallenge, CHALLENGE_CLASSES
 from CTFd.plugins.flags import get_flag_class
 from CTFd.utils.user import get_ip
 from CTFd.utils.uploads import delete_file
-from CTFd.plugins import register_plugin_assets_directory, bypass_csrf_protection
-from CTFd.schemas.tags import TagSchema
-from CTFd.models import db, ma, Challenges, Teams, Users, Solves, Fails, Flags, Files, Hints, Tags, ChallengeFiles
-from CTFd.utils.decorators import admins_only, authed_only, during_ctf_time_only, require_verified_emails
-from CTFd.utils.decorators.visibility import check_challenge_visibility, check_score_visibility
+from CTFd.plugins import register_plugin_assets_directory
+from CTFd.models import db, Challenges, Teams, Users, Solves, Fails, Flags, Hints, Tags, ChallengeFiles
+from CTFd.utils.decorators import admins_only, authed_only
 from CTFd.utils.user import get_current_team
 from CTFd.utils.user import get_current_user
-from CTFd.utils.user import is_admin, authed
 from CTFd.utils.config import is_teams_mode
 from CTFd.api import CTFd_API_v1
-from CTFd.api.v1.scoreboard import ScoreboardDetail
-import CTFd.utils.scores
-from CTFd.api.v1.challenges import ChallengeList, Challenge
 from flask_restx import Namespace, Resource
-from flask import request, Blueprint, jsonify, abort, render_template, url_for, redirect, session
-# from flask_wtf import FlaskForm
+from flask import request, Blueprint, abort, render_template, session
 from wtforms import (
     FileField,
     HiddenField,
-    PasswordField,
     RadioField,
-    SelectField,
     StringField,
-    TextAreaField,
     SelectMultipleField,
-    BooleanField,
 )
-# from wtforms import TextField, SubmitField, BooleanField, HiddenField, FileField, SelectMultipleField
-from wtforms.validators import DataRequired, ValidationError, InputRequired
-from werkzeug.utils import secure_filename
 import requests
 import tempfile
 from CTFd.utils.dates import unix_time
@@ -41,11 +27,9 @@
 import json
 import hashlib
 import random
-from CTFd.plugins import register_admin_plugin_menu_bar
 
 from CTFd.forms import BaseForm
 from CTFd.forms.fields import SubmitField
-from CTFd.utils.config import get_themes
 
 
 class DockerConfig(db.Model):

From 98ff40ae574f561958f27dd9158de4349b4b0421 Mon Sep 17 00:00:00 2001
From: Nima HeydariNasab <nima.heydari79@yahoo.com>
Date: Fri, 24 Mar 2023 23:21:50 +0330
Subject: [PATCH 4/9] Add .DS_Store to .gitignore

---
 .gitignore | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.gitignore b/.gitignore
index b6e4761..8ba67bc 100644
--- a/.gitignore
+++ b/.gitignore
@@ -127,3 +127,5 @@ dmypy.json
 
 # Pyre type checker
 .pyre/
+
+**/.DS_Store

From 8c2a5616f66eec50763b19aae9732b35e80d0260 Mon Sep 17 00:00:00 2001
From: Nima HeydariNasab <nima.heydari79@yahoo.com>
Date: Fri, 24 Mar 2023 23:30:27 +0330
Subject: [PATCH 5/9] Fix exposed ports not showing in challenge create/edit
 page

---
 docker_challenges/assets/create.js | 2 +-
 docker_challenges/assets/update.js | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/docker_challenges/assets/create.js b/docker_challenges/assets/create.js
index a318f4f..91d9196 100644
--- a/docker_challenges/assets/create.js
+++ b/docker_challenges/assets/create.js
@@ -22,7 +22,7 @@ CTFd.plugin.run((_CTFd) => {
             }
         });
     });
-        $("#docker_image").on("change", function() {
+        $("#dockerimage_select").on("change", function() {
             $.getJSON("/api/v1/docker_ports?image=" + this.value, function(result) {
                 $("#ports_text").text("Published Ports, Separated With Comma (Allowed Values: " + result["data"].join(", ") + "):");
             });
diff --git a/docker_challenges/assets/update.js b/docker_challenges/assets/update.js
index ac9a86a..da9f76d 100644
--- a/docker_challenges/assets/update.js
+++ b/docker_challenges/assets/update.js
@@ -9,7 +9,7 @@ CTFd.plugin.run((_CTFd) => {
             $("#dockerimage_select").val(DOCKER_IMAGE).change();
             $("#docker_image_ports").attr("value", DOCKER_IMAGE_PORTS);
         });
-        $("#docker_image").on("change", function() {
+        $("#dockerimage_select").on("change", function() {
             $.getJSON("/api/v1/docker_ports?image=" + this.value, function(result) {
                 $("#ports_text").text("Published Ports, Separated With Comma (Allowed Values: " + result["data"].join(", ") + "):");
             });

From 99ac9b44b5adaac34fbef2cbf6dbda6fea2632c1 Mon Sep 17 00:00:00 2001
From: Nima HeydariNasab <nima.heydari79@yahoo.com>
Date: Sat, 25 Mar 2023 00:35:52 +0330
Subject: [PATCH 6/9] Add feature to specify resource limit for containers

---
 docker_challenges/__init__.py                 | 19 +++++++++++-
 .../templates/docker_config.html              | 30 +++++++++++++++++++
 2 files changed, 48 insertions(+), 1 deletion(-)

diff --git a/docker_challenges/__init__.py b/docker_challenges/__init__.py
index fed6705..b33b5f7 100644
--- a/docker_challenges/__init__.py
+++ b/docker_challenges/__init__.py
@@ -16,6 +16,7 @@
 from wtforms import (
     FileField,
     HiddenField,
+    IntegerField,
     RadioField,
     StringField,
     SelectMultipleField,
@@ -42,6 +43,9 @@ class DockerConfig(db.Model):
     ca_cert = db.Column("ca_cert", db.String(2200), index=True)
     client_cert = db.Column("client_cert", db.String(2000), index=True)
     client_key = db.Column("client_key", db.String(3300), index=True)
+    memory_limit = db.Column("memory_limit", db.BigInteger)
+    cpu_period = db.Column("cpu_period", db.BigInteger)
+    cpu_quota = db.Column("cpu_quota", db.BigInteger)
     repositories = db.Column("repositories", db.String(1024), index=True)
 
 
@@ -69,6 +73,9 @@ class DockerConfigForm(BaseForm):
     ca_cert = FileField('CA Cert')
     client_cert = FileField('Client Cert')
     client_key = FileField('Client Key')
+    memory_limit = IntegerField('Memory Limit per Container (Bytes)')
+    cpu_period = IntegerField('CPU Period per Container (Microseconds)')
+    cpu_quota = IntegerField('CPU Quota per Container (Microseconds)')
     repositories = SelectMultipleField('Repositories')
     submit = SubmitField('Submit')
 
@@ -115,6 +122,9 @@ def docker_config():
                 b.ca_cert = None
                 b.client_cert = None
                 b.client_key = None
+            b.memory_limit = None if request.form['memory_limit'] in [None, ''] else request.form['memory_limit']
+            b.cpu_period = None if request.form['cpu_period'] in [None, ''] else request.form['cpu_period']
+            b.cpu_quota = None if request.form['cpu_quota'] in [None, ''] else request.form['cpu_quota']
             try:
                 b.repositories = ','.join(request.form.to_dict(flat=False)['repositories'])
             except:
@@ -317,7 +327,14 @@ def create_container(docker, image, team, portbl):
         ports[i] = {}
         bindings[i] = [{"HostPort": tmp_ports.pop()}]
     headers = {'Content-Type': "application/json"}
-    data = json.dumps({"Image": image, "ExposedPorts": ports, "HostConfig": {"PortBindings": bindings}})
+    params = {"Image": image, "ExposedPorts": ports, "HostConfig": {"PortBindings": bindings}}
+    if docker.memory_limit:
+        params["HostConfig"]["Memory"] = docker.memory_limit
+    if docker.cpu_period:
+        params["HostConfig"]["CpuPeriod"] = docker.cpu_period
+    if docker.cpu_quota:
+        params["HostConfig"]["CpuQuota"] = docker.cpu_quota
+    data = json.dumps(params)
     if tls:
         r = requests.post(url="%s/containers/create?name=%s" % (URL_TEMPLATE, container_name), cert=CERT,
                       verify=False, data=data, headers=headers)
diff --git a/docker_challenges/templates/docker_config.html b/docker_challenges/templates/docker_config.html
index 6a5ad6e..81011ae 100644
--- a/docker_challenges/templates/docker_config.html
+++ b/docker_challenges/templates/docker_config.html
@@ -51,6 +51,36 @@ <h1>Docker Config</h1>
                     </label>
                     <input class="form-control" type="file" name="client_key" id="key_file" {% if not config.tls_enabled %} disabled {% endif %} {% if config.tls_enabled and not config.client_key %} required {% endif %} />
                 </div>
+                <div class="form-group">
+                    <label for="memory-limit-input">
+                        Memory Limit per Container (Bytes)
+                    </label>
+                    {% if config.memory_limit %}
+                    <input class="form-control" type="number" name="memory_limit" id="memory-limit-input" placeholder="Default: 0" value='{{ config.memory_limit }}'/>
+                    {% else %}
+                    <input class="form-control" type="number" name="memory_limit" id="memory-limit-input" placeholder="Default: 0" />
+                    {% endif %}
+                </div>
+                <div class="form-group">
+                    <label for="cpu-period-input">
+                        CPU Period per Container (Microseconds)
+                    </label>
+                    {% if config.cpu_period %}
+                    <input class="form-control" type="number" name="cpu_period" id="cpu-period-input" placeholder="Default: 100000" min="0" value='{{ config.cpu_period }}'/>
+                    {% else %}
+                    <input class="form-control" type="number" name="cpu_period" id="cpu-period-input" placeholder="Default: 100000" min="0" />
+                    {% endif %}
+                </div>
+                <div class="form-group">
+                    <label for="cpu-quota-input">
+                        CPU Quota per Container (Microseconds)
+                    </label>
+                    {% if config.cpu_quota %}
+                    <input class="form-control" type="number" name="cpu_quota" id="cpu-quota-input" placeholder="Leave empty to have the default limit" min="0" value='{{ config.cpu_quota }}'/>
+                    {% else %}
+                    <input class="form-control" type="number" name="cpu_quota" id="cpu-quota-input" placeholder="Leave empty to have the default limit" min="0" />
+                    {% endif %}
+                </div>
                 <div class="form-group">
                     <label for="repo-ms">
                         Repositories

From b12739dff5bb3d640f332f0a62d674aeb44080c0 Mon Sep 17 00:00:00 2001
From: Nima HeydariNasab <nima.heydari79@yahoo.com>
Date: Tue, 28 Mar 2023 19:50:28 +0330
Subject: [PATCH 7/9] Modify get_unavailable_ports to avoid KeyError:
 'PublicPort'

---
 docker_challenges/__init__.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/docker_challenges/__init__.py b/docker_challenges/__init__.py
index b33b5f7..451740f 100644
--- a/docker_challenges/__init__.py
+++ b/docker_challenges/__init__.py
@@ -270,7 +270,8 @@ def get_unavailable_ports(docker):
     for i in r.json():
         if not i['Ports'] == []:
             for p in i['Ports']:
-                result.append(p['PublicPort'])
+                if 'PublicPort'in p:
+                    result.append(p['PublicPort'])
     return result
 
 

From 3a145cab59332e6352b5a7ac4076127e09006f89 Mon Sep 17 00:00:00 2001
From: Nima HeydariNasab <nima.heydari79@yahoo.com>
Date: Tue, 28 Mar 2023 19:52:11 +0330
Subject: [PATCH 8/9] Fix TLS connection

---
 docker_challenges/__init__.py | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/docker_challenges/__init__.py b/docker_challenges/__init__.py
index 451740f..21f3611 100644
--- a/docker_challenges/__init__.py
+++ b/docker_challenges/__init__.py
@@ -211,10 +211,11 @@ def do_request(docker, url, headers=None, method='GET'):
     URL_TEMPLATE = '%s://%s' % (prefix, host)
     try:
         if tls:
+            cert = get_client_cert(docker)
             if (method == 'GET'):
-                r = requests.get(url=f"%s{url}" % URL_TEMPLATE, cert=get_client_cert(docker), verify=False, headers=headers)
+                r = requests.get(url=f"%s{url}" % URL_TEMPLATE, cert=cert[0:2], verify=cert[2], headers=headers)
             elif (method == 'DELETE'):
-                r = requests.delete(url=f"%s{url}" % URL_TEMPLATE, cert=get_client_cert(docker), verify=False, headers=headers)
+                r = requests.delete(url=f"%s{url}" % URL_TEMPLATE, cert=cert[0:2], verify=cert[2], headers=headers)
         else:
             if (method == 'GET'):
                 r = requests.get(url=f"%s{url}" % URL_TEMPLATE, headers=headers)
@@ -232,15 +233,15 @@ def get_client_cert(docker):
         client = docker.client_cert
         ckey = docker.client_key
         ca_file = tempfile.NamedTemporaryFile(delete=False)
-        ca_file.write(ca)
+        ca_file.write(ca.encode('utf-8'))
         ca_file.seek(0)
         client_file = tempfile.NamedTemporaryFile(delete=False)
-        client_file.write(client)
+        client_file.write(client.encode('utf-8'))
         client_file.seek(0)
         key_file = tempfile.NamedTemporaryFile(delete=False)
-        key_file.write(ckey)
+        key_file.write(ckey.encode('utf-8'))
         key_file.seek(0)
-        CERT = (client_file.name, key_file.name)
+        CERT = (client_file.name, key_file.name, ca_file.name)
     except:
         print(traceback.print_exc())
         CERT = None

From d5fe27b2054162e395c4c9c35830974a6ab5fcaa Mon Sep 17 00:00:00 2001
From: Nima HeydariNasab <nima.heydari79@yahoo.com>
Date: Tue, 28 Mar 2023 20:23:07 +0330
Subject: [PATCH 9/9] Fix TLS connection when creating container

---
 docker_challenges/__init__.py | 32 ++++++--------------------------
 1 file changed, 6 insertions(+), 26 deletions(-)

diff --git a/docker_challenges/__init__.py b/docker_challenges/__init__.py
index 21f3611..3de17e9 100644
--- a/docker_challenges/__init__.py
+++ b/docker_challenges/__init__.py
@@ -288,29 +288,8 @@ def get_required_ports(docker, image):
 def create_container(docker, image, team, portbl):
     tls = docker.tls_enabled
     CERT = None
-    if not tls:
-        prefix = 'http'
-    else:
-        prefix = 'https'
-        try:
-            ca = docker.ca_cert
-            client = docker.client_cert
-            ckey = docker.client_key
-            ca_file = tempfile.NamedTemporaryFile(delete=False)
-            ca_file.write(ca)
-            ca_file.seek(0)
-            client_file = tempfile.NamedTemporaryFile(delete=False)
-            client_file.write(client)
-            client_file.seek(0)
-            key_file = tempfile.NamedTemporaryFile(delete=False)
-            key_file.write(ckey)
-            key_file.seek(0)
-            CERT = (client_file.name, key_file.name)
-        except:
-            print(traceback.print_exc())
-            return []
-    host = docker.hostname
-    URL_TEMPLATE = '%s://%s' % (prefix, host)
+    prefix = 'https' if tls else 'http'
+    URL_TEMPLATE = '%s://%s' % (prefix, docker.hostname)
     challenge = DockerChallenge.query.filter_by(docker_image=image).first()
     needed_ports = challenge.ports.split(',') if challenge.ports else get_required_ports(docker, image)
     team = hashlib.md5(team.encode("utf-8")).hexdigest()[:10]
@@ -338,10 +317,11 @@ def create_container(docker, image, team, portbl):
         params["HostConfig"]["CpuQuota"] = docker.cpu_quota
     data = json.dumps(params)
     if tls:
-        r = requests.post(url="%s/containers/create?name=%s" % (URL_TEMPLATE, container_name), cert=CERT,
-                      verify=False, data=data, headers=headers)
+        cert = get_client_cert(docker)
+        r = requests.post(url="%s/containers/create?name=%s" % (URL_TEMPLATE, container_name), cert=cert[0:2],
+                      verify=cert[2], data=data, headers=headers)
         result = r.json()
-        s = requests.post(url="%s/containers/%s/start" % (URL_TEMPLATE, result['Id']), cert=CERT, verify=False,
+        s = requests.post(url="%s/containers/%s/start" % (URL_TEMPLATE, result['Id']), cert=cert[0:2], verify=cert[2],
                           headers=headers)
     else:
         r = requests.post(url="%s/containers/create?name=%s" % (URL_TEMPLATE, container_name),