Docker: Docker registry - Revision history

Mariusz: /* Secure Docker registry with user authentication */

2019-03-15T10:44:27Z

Secure Docker registry with user authentication

Mariusz: /* Secure Docker registry with user authentication */

2019-03-15T10:43:40Z

Secure Docker registry with user authentication

Mariusz: Created page with "== Secure Docker registry with user authentication == `docker-compose.yaml` dockerauth: container_name: dockerauth image: cesanta/docker_auth port..."

2019-03-14T16:48:17Z

Created page with "== Secure Docker registry with user authentication == <code>docker-compose.yaml</code> <nowiki> dockerauth: container_name: dockerauth image: cesanta/docker_auth port..."

New page

== Secure Docker registry with user authentication ==

<code>docker-compose.yaml</code>

<nowiki>
dockerauth:
container_name: dockerauth
image: cesanta/docker_auth
ports:
- 5001:5001
volumes:
- /root/registry:/config:ro
- /var/log/docker_auth:/logs
- /etc/pki/docker-registry:/ssl:ro
command: /config/auth_config.yml
restart: always

registry:
container_name: registry
restart: always
image: registry:2
ports:
- 5000:5000
environment:
REGISTRY_HTTP_TLS_CERTIFICATE: /certs/vscaler.com.crt
REGISTRY_HTTP_TLS_KEY: /certs/vscaler.com.key
REGISTRY_AUTH: token
REGISTRY_AUTH_TOKEN_REALM: https://registry.vscaler.com:5001/auth
REGISTRY_AUTH_TOKEN_SERVICE: "Docker registry"
REGISTRY_AUTH_TOKEN_ISSUER: "Auth Service"
REGISTRY_AUTH_TOKEN_ROOTCERTBUNDLE: /certs/vscaler.com.crt
volumes:
- registry:/var/lib/registry
- /etc/pki/docker-registry:/certs:ro
</nowiki>

<code>auth_config.yml</code>

<nowiki>
# Server settings
server:
# Address to listen on
addr: ":5001"
# TLS certificate and key
certificate: "/ssl/vscaler.com.crt"
key: "/ssl/vscaler.com.key"

# Settings for the token
token:
issuer: "Auth Service" # Must match issuer in the Registry config.
expiration: 900

# Static user map
users:
# Password is specified as a BCrypt hash. Use `htpasswd -nB username` to generate.
"admin":
password: "$2y$05$3XbRMkU1lavzRK7HSO4x..9MuRGwVMphjXqX/z2krxgflr8JB9lM."
"": {} # Allow anonymous (no "docker login") access

acl:
# Admin has full access to everything
- match: {account: "admin"}
actions: ["*"]
# Anonymous users can pull all images
- match: {account: ""}
actions: ["pull"]
# Access is denied by default
</nowiki>
(admin's password is "admin" - without quotes)

To create containers, run:
<nowiki>
docker-compose up -d
</nowiki>
as root in the directory with <code>docker-compose.yaml</code> (currently <code>/root/registry/</code>).

=== Usage ===
As an anonymous user (without logging in):

<nowiki>
[root@vscaler-vgpu ~]# docker run -d --privileged --name dind --add-host registry.vscaler.com:172.28.139.124 docker:stable-dind
[root@vscaler-vgpu ~]# docker exec -it dind /bin/sh
/ # docker pull registry.vscaler.com:5000/alpine:latest
latest: Pulling from alpine
8e402f1a9c57: Pull complete
Digest: sha256:d05ecd4520cab5d9e5d877595fb0532aadcd6c90f4bbc837bc11679f704c4c82
Status: Downloaded newer image for registry.vscaler.com:5000/alpine:latest
/ # docker pull hello-world
Using default tag: latest
latest: Pulling from library/hello-world
1b930d010525: Pull complete
Digest: sha256:2557e3c07ed1e38f26e389462d03ed943586f744621577a99efb77324b0fe535
Status: Downloaded newer image for hello-world:latest
/ # docker tag hello-world registry.vscaler.com:5000/hello-world:mariusz
/ # docker push registry.vscaler.com:5000/hello-world:mariusz
The push refers to repository [registry.vscaler.com:5000/hello-world]
af0b15c8625b: Preparing
denied: requested access to the resource is denied
</nowiki>
Log in as an admin:
<nowiki>
/ # docker login registry.vscaler.com:5000
Username: admin
Password:
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded
/ # docker push registry.vscaler.com:5000/hello-world:mariusz
The push refers to repository [registry.vscaler.com:5000/hello-world]
af0b15c8625b: Pushed
mariusz: digest: sha256:92c7f9c92844bbbb5d0a101b22f7c2a7949e40f8ea90c8b3bc396879d95e899a size: 524
/ # docker rmi registry.vscaler.com:5000/alpine:latest
Untagged: registry.vscaler.com:5000/alpine:latest
Untagged: registry.vscaler.com:5000/alpine@sha256:d05ecd4520cab5d9e5d877595fb0532aadcd6c90f4bbc837bc11679f704c4c82
Deleted: sha256:5cb3aa00f89934411ffba5c063a9bc98ace875d8f92e77d0029543d9f2ef4ad0
Deleted: sha256:bcf2f368fe234217249e00ad9d762d8f1a3156d60c442ed92079fa5b120634a1
/ # docker pull registry.vscaler.com:5000/alpine:latest
latest: Pulling from alpine
8e402f1a9c57: Pull complete
Digest: sha256:d05ecd4520cab5d9e5d877595fb0532aadcd6c90f4bbc837bc11679f704c4c82
Status: Downloaded newer image for registry.vscaler.com:5000/alpine:latest
</nowiki>

@@ Line 3: / Line 3: @@
 # the registry to store images in
-# an authentication system to authenticate users
+# an authentication service to authenticate users
 [[File:V2-registry-auth.png]]

@@ Line 1: / Line 1: @@
 == Secure Docker registry with user authentication ==
-<code>docker-compose.yaml</code>
+# the registry to store images in
   <nowiki>
 dockerauth:
@@ Line 35: / Line 42: @@
 </nowiki>
-<code>auth_config.yml</code>
+<code>docker_auth</code> provides an implementation of the Token Auth specification [2] that supports multiple authentication methods (see README in the GitHub repo). The simplest of them is a static list of users who's credentials (hashed) have to be added to the service's config file:
   <nowiki>
 # Server settings
@@ Line 67: / Line 75: @@
    # Access is denied by default
 </nowiki>
-(admin's password is "admin" - without quotes)
+On the above admin's password is "admin" - without quotes. To hash a passwords, run <code>docker run --rm -it httpd htpasswd -nB <username></code>.
 To create containers, run:
@@ Line 76: / Line 90: @@
-=== Usage ===
+=== Usage (testing) ===
 As an anonymous user (without logging in):
   <nowiki>
 / # docker pull registry.vscaler.com:5000/alpine:latest
 latest: Pulling from alpine
@@ Line 99: / Line 117: @@
 denied: requested access to the resource is denied
 </nowiki>
 Log in as an admin:
   <nowiki>
@@ Line 124: / Line 144: @@
 Status: Downloaded newer image for registry.vscaler.com:5000/alpine:latest
 </nowiki>

Docker: Docker registry - Revision history

Mariusz: /* Secure Docker registry with user authentication */

Mariusz: /* Secure Docker registry with user authentication */

Mariusz: Created page with "== Secure Docker registry with user authentication == docker-compose.yaml dockerauth: container_name: dockerauth image: cesanta/docker_auth port..."

Mariusz: Created page with "== Secure Docker registry with user authentication == `docker-compose.yaml` dockerauth: container_name: dockerauth image: cesanta/docker_auth port..."