Docker : Use Docker-Registry
2017/07/30 |
Install Docker-Registry to build Private Registry for Docker images.
This example is based on the case to use self-signed certificates. |
|
[1] |
This example is based on the environment that SELnux is Permissive or Disabled.
|
[2] |
On The Host which Docker-Registry Container runs, Create SSL Certificates, refer to here.
This example is based on the case that SSL certificates are made under the [/etc/pki/tls/certs] and set the [Common Name] as [dlp.srv.world]. |
[3] | Copy to locate Certificates and pull Registry Image (v2). Container Images are located under [/var/lib/regstry] on Registry v2 Container, so map to mount [/var/lib/docker/registry] on parent Host for Registry Container to use as Persistent Storage |
[root@dlp ~]#
[root@dlp ~]# mkdir /etc/docker/certs.d/dlp.srv.world:5000 [root@dlp ~]# cp -p /etc/pki/tls/certs/server.crt /etc/pki/tls/certs/domain.crt [root@dlp ~]# cp -p /etc/pki/tls/certs/server.key /etc/pki/tls/certs/domain.key [root@dlp ~]# cp -p /etc/pki/tls/certs/server.crt /etc/docker/certs.d/dlp.srv.world:5000/ca.crt
docker pull registry:2 [root@dlp ~]# mkdir /var/lib/docker/registry [root@dlp ~]# docker run -d -p 5000:5000 \
[root@dlp ~]# -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt \ -e REGISTRY_HTTP_TLS_KEY=/certs/domain.key \ -v /etc/pki/tls/certs:/certs \ -v /var/lib/docker/registry:/var/lib/registry \ registry:2 docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES e7338be2ddd4 registry:2 "/entrypoin..." 23 seconds ago Up 21 seconds 0.0.0.0:5000->5000/tcp loving_h.. |
[4] | If Firewalld is running, allow mapped port. |
[root@dlp ~]# firewall-cmd --add-port=5000/tcp --permanent success [root@dlp ~]# firewall-cmd --reload success |
[5] | For pushing local Image to Registry Container server, set like follows. |
# list images on Registry container [root@dlp ~]# curl -k https://localhost:5000/v2/_catalog {"repositories":[]} docker images REPOSITORY TAG IMAGE ID CREATED SIZE docker.io/registry 2 751f286bc25e 10 days ago 33.2 MB registry.fedoraproject.org/fedora latest 7f17e6b4a386 4 weeks ago 232 MB # set a tag and push [root@dlp ~]# docker tag fedora dlp.srv.world:5000/fedora_reg [root@dlp ~]# docker push dlp.srv.world:5000/fedora_reg The push refers to a repository [dlp.srv.world:5000/fedora_reg] 42ce6d637cc2: Pushed latest: digest: sha256:9bc40b04427b92a009c416e06997f4f2de424185b7d52bb6def93df75b9d99d2 size: 529 [root@dlp ~]# docker images REPOSITORY TAG IMAGE ID CREATED SIZE docker.io/registry 2 751f286bc25e 10 days ago 33.2 MB dlp.srv.world:5000/fedora_reg latest 7f17e6b4a386 4 weeks ago 232 MB registry.fedoraproject.org/fedora latest 7f17e6b4a386 4 weeks ago 232 MB[root@dlp ~]# curl -k https://localhost:5000/v2/_catalog {"repositories":["fedora_reg"]} |
[6] | For getting images from Registry Container server on a Docker node, set like follows. |
# get certificates from Registry Container [root@node01 ~]# mkdir /etc/docker/certs.d/dlp.srv.world:5000 [root@node01 ~]# cd /etc/docker/certs.d/dlp.srv.world:5000 [root@node01 dlp.srv.world:5000]# scp dlp.srv.world:"/etc/docker/certs.d/dlp.srv.world:5000/ca.crt" ./
docker pull dlp.srv.world:5000/fedora_reg Using default tag: latest Trying to pull repository dlp.srv.world:5000/fedora_reg ... sha256:9bc40b04427b92a009c416e06997f4f2de424185b7d52bb6def93df75b9d99d2: Pulling from dlp.srv.world:5000/fedora_reg 4ca659ae84e5: Pull complete Digest: sha256:9bc40b04427b92a009c416e06997f4f2de424185b7d52bb6def93df75b9d99d2 Status: Downloaded newer image for dlp.srv.world:5000/fedora_reg:latest [root@node01 ~]# docker images REPOSITORY TAG IMAGE ID CREATED SIZE dlp.srv.world:5000/fedora_reg latest 7f17e6b4a386 4 weeks ago 232 MB |