Cloud Knowledge Base and Cloud Admin Tutorials

A Docker Registry is a service which you can push Docker images to for storage and sharing. We can deploy our own private Docker Registry behind our firewall with SSL encryption and HTTP authentication. Here we can use centos 7 to install docker registry and using Apache for secure connection with htpasswd.

Docker Private Registry Installation

There are many ways available to install Docker Private Registry on CentOS 7.

Install Docker Private Registry Container

The easiest way to install docker private registry using the container.

Step 1

Install docker

Step 2

Install docker private registry

• mount registry volume /var/lib/registry

Syntax,

 docker run -d -p 5000:5000 --restart=always --name registry -v <volume-location>:/var/lib/registry registry

Example

# docker run -d -p 5000:5000 --restart=always --name registry -v /var/lib/registry:/var/lib/registry registry

You can connect docker private registry using <hostname/ip>:5000

Browse http://<hostname/ip>:5000/v2/_catalog

Add your registry with docker daemon and push images.

Configure Secure Docker Private Registry

You can use Apache or Nginx web server to configure the registry.

Step 1

Install registry to listening only with localhost.

# docker run -d -p 127.0.0.1:5000:5000 --restart=always --name registry -v /var/lib/registry:/var/lib/registry -v /etc/docker/registry:/etc/docker/registry registry

Step 2

Install Nginx

# yum install epel-release -y
# yum install nginx -y

# cd /etc/nginx/conf.d/
# vi registry.conf

upstream docker-registry {
server 127.0.0.1:5000;
}

server {
listen 443 ssl;
server_name registry.cloudkb.net;

# SSL
ssl_certificate  /etc/nginx/cloudkb.pem;
ssl_certificate_key  /etc/nginx/cloudkb.pem;

# Recommendations from https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
ssl_protocols TLSv1.1 TLSv1.2;
ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;

# disable any limits to avoid HTTP 413 for large image uploads
client_max_body_size 0;

# required to avoid HTTP 411: see Issue #1486 (https://github.com/moby/moby/issues/1486)
chunked_transfer_encoding on;

location /v2/ {
# Do not allow connections from docker 1.5 and earlier
# docker pre-1.6.0 did not properly set the user agent on ping, catch "Go *" user agents
if ($http_user_agent ~ "^(docker\/1\.(3|4|5(?!\.[0-9]-dev))|Go ).*$" ) {
return 404;
}

# To add basic authentication to v2 use auth_basic setting.
#auth_basic "Registry realm";
#auth_basic_user_file /etc/nginx/.htpasswd;

## If $docker_distribution_api_version is empty, the header will not be added.
## See the map directive above where this variable is defined.
#add_header 'Docker-Distribution-Api-Version' $docker_distribution_api_version always;

proxy_pass http://docker-registry;
proxy_set_header Host $http_host; # required for docker client's sake
proxy_set_header X-Real-IP $remote_addr; # pass on real client's IP
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 900;
}
}

Make sure the SSL configuration with your domain name and SSL certificate location.

#server_name

# ssl_certificate_key

# ssl_certificate

Step 3

Restart Nginx service.

Note: SELinux should be a permissive mode to access proxy.

# setenforce 0

Step 4

It is not required to add with docker deamon. Use this command to login the registry.

# docker login <server_name>

Configure Docker Private Registry with Authentication

Step 1

Install htpasswd and enable user auth.

htpasswd -c /etc/nginx/.htpasswd  guestuser

Step 2

Enable this configuration in registry.conf

#auth_basic “Registry realm”;
#auth_basic_user_file /etc/nginx/.htpasswd;

Step 3 

Restart Nginx service and connect your registry with authentication.

# docker login <server_name>

Install Private Docker Registry on Centos 7

Docker registry OLD V1 version Installation.

Update all packages and install docker registry

#yum update
#yum install docker-registry

#systemctl enable docker-registry.service
#service docker-registry start

Change your customized registry storage path if you required.

vi /etc/docker-registry.yml

search the storage path location and change it.

local
storage_path =

Once the changes are completed restart docker registry.

To verify the docker registry, use curl command

#curl 192.168.1.88:5000
“\”docker-registry server\””

That’s it!! Your insecure registry is working now.

Browse your Insecure Registry docker registry

http://192.168.1.88:5000/
Tag your images to push to the registry

Example

#docker tag <imageID> 192.168.1.88:5000/centos

Run your insecure docker registry with docker

#service docker stop

#docker -d --insecure-registry 192.168.1.88:5000 &

or

change your docker startup script with insecure registry

#vi /usr/lib/systemd/system/docker.service

add insecure registry url on ExecStart

–insecure-registry 192.168.1.88:5000

Example entry

ExecStart=/usr/bin/docker -d $OPTIONS \
 $DOCKER_STORAGE_OPTIONS \
 $DOCKER_NETWORK_OPTIONS \
 $ADD_REGISTRY \
 $BLOCK_REGISTRY \
 --insecure-registry 192.168.1.88:5000

Push your images

#docker push 192.168.1.88:5000/centos

Your images will successfully be pushed to insecure registry

Pull your images

change your docker startup script with insecure registry as per previous step

#docker pull 192.168.1.88:5000/centos

You are done with insecure registry

Secure Docker Private Registry

In order to use docker registry with secure URL, try to install apache and configure SSL.

install apache with mod SSL.

#yum install httpd mod_ssl

Create user authentication using htpasswd for docker registry

# htpasswd -c /etc/httpd/.htpasswd USERNAME

create your SSL certificate whether Self Signed or valid SSL cert, open your ssl.conf and add proxy settings before </VirtualHost>

#vi /etc/httpd/conf.d/ssl.conf

ProxyRequests off
 ProxyPreserveHost on
 ProxyPass / http://127.0.0.1:5000/
 ProxyPassReverse / http://127.0.0.1:5000/

<Location />
 Order deny,allow
 Allow from all

AuthName "Registry Authentication"
 AuthType basic
 AuthUserFile "/etc/httpd/.htpassword"
 Require valid-user
 </Location>

# Allow ping and users to run unauthenticated.
 <Location /v1/_ping>
 Satisfy any
 Allow from all
 </Location>
 # Allow ping and users to run unauthenticated.
 <Location /_ping>
 Satisfy any
 Allow from all
 </Location>

Change the valid SSL certificate paths

SSLCertificateFile
SSLCertificateKeyFile
Now you try to restart httpd service.

# service httpd restart

Browse your registry with SSL and make sure it works.

https://192.168.1.88/
Now you can login to private registry server

docker login https://192.168.1.88/

provide your username and password, the same you provided when creating the htpasswd file.

-Push your images to docker registry

#docker push 192.168.1.88/centos

Docker registry itself authentication setup

New private docker repository moved as docker distribution. Once you installed docker registry.

Create htpasswd in any file, example /etc/nginx/.htpasswd

example,

# htpasswd -c /etc/nginx/.htpasswd admin

Once done, modify the following docker distribution configuration config

vi /etc/docker-distribution/registry/config.yml

add the additional auth configuration.

auth:
 htpasswd:
 realm: basic-realm
 path: /etc/nginx/.htpasswd

Example config.yml file

version: 0.1
log:
 fields:
 service: registry
storage:
 cache:
 layerinfo: inmemory
 filesystem:
 rootdirectory: /var/lib/registry
http:
 addr: :5000
auth:
 htpasswd:
 realm: basic-realm
 path: /etc/nginx/.htpasswd

Restart docker registry service.

Done, before you push or pull the images. you must log in the Docker registry.

docker login 192.168.1.88:5000