A Docker Registry is a service which you can push Docker images to for storage and sharing. We can deploy our own private Docker Registry behind our firewall with SSL encryption and HTTP authentication. Here we can use centos 7 to install docker registry and using Apache for secure connection with htpasswd.
Docker Private Registry Installation
There are many ways available to install Docker Private Registry on CentOS 7.
Install Docker Private Registry Container
The easiest way to install docker private registry using the container.
Step 1
Install docker
Step 2
Install docker private registry
- mount registry volume /var/lib/registry
Syntax,
docker run -d -p 5000:5000 --restart=always --name registry -v <volume-location>:/var/lib/registry registry
Example
# docker run -d -p 5000:5000 --restart=always --name registry -v /var/lib/registry:/var/lib/registry registry
You can connect docker private registry using <hostname/ip>:5000
Browse http://<hostname/ip>:5000/v2/_catalog
Add your registry with docker daemon and push images.
Configure Secure Docker Private Registry
You can use Apache or Nginx web server to configure the registry.
Step 1
Install registry to listening only with localhost.
# docker run -d -p 127.0.0.1:5000:5000 --restart=always --name registry -v /var/lib/registry:/var/lib/registry -v /etc/docker/registry:/etc/docker/registry registry
Step 2
Install Nginx
# yum install epel-release -y # yum install nginx -y
# cd /etc/nginx/conf.d/ # vi registry.conf
upstream docker-registry {
server 127.0.0.1:5000;
}
server {
listen 443 ssl;
server_name registry.cloudkb.net;
# SSL
ssl_certificate /etc/nginx/cloudkb.pem;
ssl_certificate_key /etc/nginx/cloudkb.pem;
# Recommendations from https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
ssl_protocols TLSv1.1 TLSv1.2;
ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
# disable any limits to avoid HTTP 413 for large image uploads
client_max_body_size 0;
# required to avoid HTTP 411: see Issue #1486 (https://github.com/moby/moby/issues/1486)
chunked_transfer_encoding on;
location /v2/ {
# Do not allow connections from docker 1.5 and earlier
# docker pre-1.6.0 did not properly set the user agent on ping, catch "Go *" user agents
if ($http_user_agent ~ "^(docker\/1\.(3|4|5(?!\.[0-9]-dev))|Go ).*$" ) {
return 404;
}
# To add basic authentication to v2 use auth_basic setting.
#auth_basic "Registry realm";
#auth_basic_user_file /etc/nginx/.htpasswd;
## If $docker_distribution_api_version is empty, the header will not be added.
## See the map directive above where this variable is defined.
#add_header 'Docker-Distribution-Api-Version' $docker_distribution_api_version always;
proxy_pass http://docker-registry;
proxy_set_header Host $http_host; # required for docker client's sake
proxy_set_header X-Real-IP $remote_addr; # pass on real client's IP
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 900;
}
}
Make sure the SSL configuration with your domain name and SSL certificate location.
#server_name
# ssl_certificate_key
# ssl_certificate
Step 3
Restart Nginx service.
Note: SELinux should be a permissive mode to access proxy.
# setenforce 0
Step 4
It is not required to add with docker deamon. Use this command to login the registry.
# docker login <server_name>
Configure Docker Private Registry with Authentication
Step 1
Install htpasswd and enable user auth.
htpasswd -c /etc/nginx/.htpasswd guestuser
Step 2
Enable this configuration in registry.conf
#auth_basic “Registry realm”;
#auth_basic_user_file /etc/nginx/.htpasswd;
Step 3
Restart Nginx service and connect your registry with authentication.
# docker login <server_name>
Install Private Docker Registry on Centos 7
Docker registry OLD V1 version Installation.
Update all packages and install docker registry
#yum update #yum install docker-registry
#systemctl enable docker-registry.service #service docker-registry start
Change your customized registry storage path if you required.
vi /etc/docker-registry.yml
search the storage path location and change it.
local
storage_path =
Once the changes are completed restart docker registry.
To verify the docker registry, use curl command
#curl 192.168.1.88:5000
“\”docker-registry server\””
That’s it!! Your insecure registry is working now.
Browse your Insecure Registry docker registry
http://192.168.1.88:5000/
Tag your images to push to the registry
Example
#docker tag <imageID> 192.168.1.88:5000/centos
Run your insecure docker registry with docker
#service docker stop
#docker -d --insecure-registry 192.168.1.88:5000 &
or
change your docker startup script with insecure registry
#vi /usr/lib/systemd/system/docker.service
add insecure registry url on ExecStart
–insecure-registry 192.168.1.88:5000
Example entry
ExecStart=/usr/bin/docker -d $OPTIONS \ $DOCKER_STORAGE_OPTIONS \ $DOCKER_NETWORK_OPTIONS \ $ADD_REGISTRY \ $BLOCK_REGISTRY \ --insecure-registry 192.168.1.88:5000
Push your images
#docker push 192.168.1.88:5000/centos
Your images will successfully be pushed to insecure registry
Pull your images
change your docker startup script with insecure registry as per previous step
#docker pull 192.168.1.88:5000/centos
You are done with insecure registry
Secure Docker Private Registry
In order to use docker registry with secure URL, try to install apache and configure SSL.
install apache with mod SSL.
#yum install httpd mod_ssl
Create user authentication using htpasswd for docker registry
# htpasswd -c /etc/httpd/.htpasswd USERNAME
create your SSL certificate whether Self Signed or valid SSL cert, open your ssl.conf and add proxy settings before </VirtualHost>
#vi /etc/httpd/conf.d/ssl.conf
ProxyRequests off ProxyPreserveHost on ProxyPass / http://127.0.0.1:5000/ ProxyPassReverse / http://127.0.0.1:5000/
<Location /> Order deny,allow Allow from all
AuthName "Registry Authentication" AuthType basic AuthUserFile "/etc/httpd/.htpassword" Require valid-user </Location>
# Allow ping and users to run unauthenticated. <Location /v1/_ping> Satisfy any Allow from all </Location> # Allow ping and users to run unauthenticated. <Location /_ping> Satisfy any Allow from all </Location>
Change the valid SSL certificate paths
SSLCertificateFile
SSLCertificateKeyFile
Now you try to restart httpd service.
# service httpd restart
Browse your registry with SSL and make sure it works.
https://192.168.1.88/
Now you can login to private registry server
docker login https://192.168.1.88/
provide your username and password, the same you provided when creating the htpasswd file.
-Push your images to docker registry
#docker push 192.168.1.88/centos
Docker registry itself authentication setup
New private docker repository moved as docker distribution. Once you installed docker registry.
Create htpasswd in any file, example /etc/nginx/.htpasswd
example,
# htpasswd -c /etc/nginx/.htpasswd admin
Once done, modify the following docker distribution configuration config
vi /etc/docker-distribution/registry/config.yml
add the additional auth configuration.
auth: htpasswd: realm: basic-realm path: /etc/nginx/.htpasswd
Example config.yml file
version: 0.1 log: fields: service: registry storage: cache: layerinfo: inmemory filesystem: rootdirectory: /var/lib/registry http: addr: :5000 auth: htpasswd: realm: basic-realm path: /etc/nginx/.htpasswd
Restart docker registry service.
Done, before you push or pull the images. you must log in the Docker registry.
docker login 192.168.1.88:5000
Related Posts:
