setup Docker private registry

一、 普通模式， no ssl

setup private docker registry (参考 https://www.digitalocean.com/community/tutorials/how-to-set-up-a-private-docker-registry-on-ubuntu-14-04 and http://www.dropbit.ch/private-docker-registry-with-nginx-on-centos-7/   )

On dedicated Docker private registry host, we use CentOS7:

add CentOS-Extras repository

yum -y install docker-registry
systemctl start docker-registry
systemctl enable docker-registry

install docker to pull images you needed, then

vi /etc/sysconfig/docker
INSECURE_REGISTRY='--insecure-registry=docker-registry-host:5000'

systemctl restart docker

docker tag image-id registry-host-name:5000/ubuntu:14.04.2 , etc

docker push registry-host-name:5000/ubuntu:14.04.2, etc

查看docker private registry:

curl http://registry-host-name:5000/v1/search

on normal docker hosts that want to use this private registry:

CentOS7:
vi /etc/sysconfig/docker
INSECURE_REGISTRY='--insecure-registry=docker-registry-host:5000'

systemctl restart docker
docker pull docker-registry-host:5000/ubuntu:14.04.2

CentOS6:
vi /etc/sysconfig/docker
other_args="--registry-mirror=http://8c6d2546.m.daocloud.io --insecure-registry=docker-registry-host:5000"

service docker restart
docker pull docker-registry-host:5000/ubuntu:14.04.2

Ubuntu 14.04.2
vi /etc/default/docker
DOCKER_OPTS="--registry-mirror=http://8c6d2546.m.daocloud.io --insecure-registry=192.168.1.6:5000"

service docker restart
docker pull docker-registry-host:5000/ubuntu:14.04.2

Notes: docker run -d -p 5000:5000 -v /opt/docker/registry:/tmp/registry registry:latest

一、 安全模式， with ssl

On dedicated Docker private registry host, we use CentOS7:

add CentOS-Extras repository
yum -y install docker-registry
systemctl start docker-registry
systemctl enable docker-registry

1. Installing Nginx:
add EPEL repository
yum -y install nginx
systemctl enable nginx
systemctl start nginx

2. Configure access through Nginx to your private docker registry
vi /etc/hosts
ip-address-of-docker-registry    www.ilovedocker.com

mkdir /etc/nginx/sites-available
vi /etc/nginx/sites-available/docker-registry
# For versions of Nginx > 1.3.9 that include chunked transfer encoding support
# Replace with appropriate values where necessary

upstream private-docker-registry {
 server localhost:5000;
}

server {
 listen 443;
 server_name www.ilovedocker.com;

 #ssl on;
 #ssl_certificate /etc/pki/tls/certs/www.ilovedocker.com.crt;
 #ssl_certificate_key /etc/pki/tls/private/www.ilovedocker.com.key;

 proxy_set_header Host       $http_host;   # required for Docker client sake
 proxy_set_header X-Real-IP  $remote_addr; # pass on real client IP

 client_max_body_size 0; # disable any limits to avoid HTTP 413 for large image uploads

 # required to avoid HTTP 411: see Issue #1486 (https://github.com/dotcloud/docker/issues/1486)
 chunked_transfer_encoding on;

 location / {
     # let Nginx know about our auth file
     auth_basic              "Restricted";
     auth_basic_user_file    docker-registry.htpasswd;

     proxy_pass http://private-docker-registry;
 }
 location /_ping {
     auth_basic off;
     proxy_pass http://private-docker-registry;
 }
 location /v1/_ping {
     auth_basic off;
     proxy_pass http://private-docker-registry;
 }

}

vi /etc/sysconfig/docker-registry
REGISTRY_ADDRESS=127.0.0.1

systemctl restart docker-registry

yum -y install httpd-tools
htpasswd -c /etc/nginx/docker-registry.htpasswd USERNAME
Open the file /etc/nginx/nginx.conf and add after the line “include /etc/nginx/conf.d/*.conf;”the following:
include /etc/nginx/sites-enabled/*;

mkdir /etc/nginx/sites-enabled
ln -s /etc/nginx/sites-available/docker-registry /etc/nginx/sites-enabled/docker-registry
systemctl reload nginx

curl USER:[email protected]:443


3. Configure Nginx to use ssl
mkdir ~/certs
cd ~/certs

create a new root key:
openssl genrsa -out dockerCA.key 2048

create a root certificate, you don’t have to answer the upcoming question, just hit enter:
openssl req -x509 -new -nodes -key dockerCA.key -days 3650 -out dockerCA.crt

create a private key for your Nginx Server:
openssl genrsa -out www.ilovedocker.com.key 2048

Next a certificate signing request is needed:
openssl req -new -key www.ilovedocker.com.key -out www.ilovedocker.com.csr
Answer the upcoming question for “Common Name” with the domain of your server, e.g: www.ilovedocker.com. Don’t provide a challenge password.

sign the certificate request:
openssl x509 -req -in www.ilovedocker.com.csr -CA dockerCA.crt -CAkey dockerCA.key -CAcreateserial -out www.ilovedocker.com.crt -days 3650

vi /etc/nginx/sites-available/docker-registry to uncomment ssl lines

cp www.ilovedocker.com.crt /etc/pki/tls/certs/
cp www.ilovedocker.com.key /etc/pki/tls/private/

update-ca-trust enable
cp dockerCA.crt /etc/pki/ca-trust/source/anchors/
update-ca-trust extract
systemctl reload nginx

curl https://USER:[email protected]

4. on remote docker host

docker with your private remote docker registry
Ubuntu 14.04:
vi /etc/hosts
ip-address-of-docker-registry    www.ilovedocker.com

copy dockerCA.crt to /usr/local/share/ca-certificates
update-ca-certificates

CentOS6/7:
vi /etc/hosts
ip-address-of-docker-registry    www.ilovedocker.com

copy dockerCA.crt to /etc/pki/ca-trust/source/anchors
update-ca-trust enable
update-ca-trust extract

docker login https://www.ilovedocker.com
docker pull ubuntu
docker tag ubuntu www.ilovedocker.com/ubuntu:hj
docker push www.ilovedocker.com/ubuntu:hj