...
instance_groups:
- name: windows-vm
  instances: 1
  jobs:
    - name: docker
      release: windows-tools
      properties:
        docker:
          tls: ((docker_tls))

...
variables:
- name: default_ca
  type: certificate
  options:
    is_ca: true
    common_name: ca

- name: docker_tls
  type: certificate
  options:
    ca: default_ca
    common_name: ((internal_ip))
    alternative_names:
    - docker.local
    - 127.0.0.1
    - ((internal_ip))
    extended_key_usage:
    - client_auth
    - server_auth

bosh deploy manifest.yml -v internal_ip=<vm ip> --vars-store creds.yml

mkdir ~/.docker/my-windows-vm
bosh interpolate creds.yml --path=/docker_tls/ca > ~/.docker/my-windows-vm/ca.pem
bosh interpolate creds.yml --path=/docker_tls/certificate > ~/.docker/my-windows-vm/cert.pem
bosh interpolate creds.yml --path=/docker_tls/private_key > ~/.docker/my-windows-vm/key.pem

export DOCKER_HOST=tcp://<vm ip>:2376
export DOCKER_TLS_VERIFY=1
export DOCKER_CERT_PATH=~/.docker/my-windows-vm

docker run -it microsoft/nanoserver:<os tag>