Set up an stunnel endpoint for the engine.

blimp/docs/container.md

Index: blimp/docs/container.md
diff --git a/blimp/docs/container.md b/blimp/docs/container.md
index 36a5ceee32266b196e117e820eac244a690114de..3f5eb0e7c78e69891c8ed7f120c208ff2f94e2c1 100644
--- a/blimp/docs/container.md
+++ b/blimp/docs/container.md
@@ -59,31 +59,43 @@ Using the tarfile you can create a Docker image:
 docker build -t blimp_engine - < ./out-linux/Debug/blimp_engine_bundle.tar
 ```
 
-## Create Docker Container
+## Running the Engine in a Docker Container
 
-From the Docker image you can create a Docker container (i.e. run the engine):
+After building the Docker image you can launch the engine inside the Docker
+container.
 
-```bash
-docker run blimp_engine
-```
+### Setting up an Environment
 
-You can also pass additional flags:
+A little prep work is necessary to enable the engine to start as it requires a
+few files that are not provided by the container, namely the client token file
+and a key/cert pair for stunnel to start up. This should be a one-time
+operation, and you can use the same directory for subsequent runs of the engine.
 
 ```bash
-docker run blimp_engine --with-my-flags
+CONFIG_DIR=/path/to/dir
+mkdir -p -m 0755 $CONFIG_DIR
+cd $CONFIG_DIR
+openssl genrsa -out tmp.key 2048
+openssl req -subj "/CN=domain.com/O=Blimp/C=US" \
+  -new -key tmp.key -days 365 -nodes -x509 -out stunnel.pem
+cat tmp.key >> stunnel.pem && rm tmp.key
+echo "token" > $CONFIG_DIR/client_token
+chmod 644 stunnel.pem client_token
 ```
 
-See the [blimp engine `Dockerfile`](../engine/Dockerfile) to find out what flags
-are passed by default.
+### Running the Engine
 
-### Mapping Volumes into the Docker Container
+Once the `$CONFIG_DIR` is set up, you can launch the engine in the Docker
+container:
 
-If you need to map a directory into the Docker container (eg. for necessary
-files):
+```bash
+docker run -v $CONFIG_DIR:/engine/data -p 443:25466 blimp_engine
+```
+You can also pass additional flags:
 
 ```bash
-docker run -v /path/to/srcdir:/path/to/docker/destdir blimp_engine
+docker run ... blimp_engine --with-my-flags
 ```
+See the [blimp engine `Dockerfile`](../engine/Dockerfile) to find out what flags
+are passed by default.
 
-NB: The permissions of the directory and the files outside of the Docker
-container will be carried over into the container.