-
Notifications
You must be signed in to change notification settings - Fork 0
/
DockerRegistry.txt
126 lines (93 loc) · 3.3 KB
/
DockerRegistry.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
#get latest registry image
sudo docker pull registry:latest
#run registry image for private registry
sudo docker run -p 5000:5000 registry
--------------------Set Up Docker Registry-------------------
sudo apt-get -y install apache2-utils
mkdir ~/docker-registry && cd $_
nano docker-compose.yml
--data in compose file
registry:
image: registry:2
ports:
- 127.0.0.1:5000:5000
environment:
REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY: /data
volumes:
- ./data:/data
sudo apt install docker-compose
sudo docker-compose up
--Ctrl+C to shut down registry and create nginx server
mkdir ~/docker-registry/nginx
nano docker-compose.yml
--enter below data on top line of compose file
nginx:
image: "nginx:1.9"
ports:
- 443:443
links:
- registry:registry
volumes:
- ./nginx/:/etc/nginx/conf.d:ro
--create Nginx config
nano ~/docker-registry/nginx/registry.conf
--enter below data in nginx file
upstream docker-registry {
server registry:5000;
}
server {
listen 443;
#server_name shsanto-vm.org;
# SSL
ssl on;
ssl_certificate /etc/nginx/conf.d/domain.crt;
ssl_certificate_key /etc/nginx/conf.d/domain.key;
# disable any limits to avoid HTTP 413 for large image uploads
client_max_body_size 0;
# required to avoid HTTP 411: see Issue #1486 (https://github.com/docker/docker/issues/1486)
chunked_transfer_encoding on;
location /v2/ {
# Do not allow connections from docker 1.5 and earlier
# docker pre-1.6.0 did not properly set the user agent on ping, catch "Go *" user agents
if ($http_user_agent ~ "^(docker\/1\.(3|4|5(?!\.[0-9]-dev))|Go ).*$" ) {
return 404;
}
# To add basic authentication to v2 use auth_basic setting plus add_header
auth_basic "registry.localhost";
auth_basic_user_file /etc/nginx/conf.d/registry.password;
add_header 'Docker-Distribution-Api-Version' 'registry/2.0' always;
proxy_pass http://docker-registry;
proxy_set_header Host $http_host; # required for docker client's sake
proxy_set_header X-Real-IP $remote_addr; # pass on real client's IP
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 900;
}
}
--run docker compose
sudo docker-compose up
--Test 5000 of registry and 443 of nginx
curl http://localhost:5000/v2/
curl http://localhost:443/v2/
--Set up authentication
cd ~/docker-registry/nginx
htpasswd -c registry.password USERNAME
--run docker compose
sudo docker-compose up
--Signing up own certificate
cd ~/docker-registry/nginx
openssl genrsa -out devdockerCA.key 2048
openssl req -x509 -new -nodes -key devdockerCA.key -days 10000 -out devdockerCA.crt
openssl genrsa -out domain.key 2048
openssl req -new -key domain.key -out dev-docker-registry.com.csr
Do not enter a challenge password and IP or address.
openssl x509 -req -in dev-docker-registry.com.csr -CA devdockerCA.crt -CAkey devdockerCA.key -CAcreateserial -out domain.crt -days 10000
sudo mkdir /usr/local/share/ca-certificates/docker-dev-cert
sudo cp devdockerCA.crt /usr/local/share/ca-certificates/docker-dev-cert
sudo update-ca-certificates
--restart docker
sudo service docker restart
cd ~/docker-registry
sudo docker-compose up
--check url
curl -k https://reguser:123@192.168.56.103/v2/