A Docker Adventure: Setting Up Your Own Private Docker Registry Inside A Docker Container
Command Palette
Search for a command to run...
Comments
Join the discussionNo comments yet. Be the first to comment.
Search for a command to run...
No comments yet. Be the first to comment.
Have you ever wanted to have your own private Docker registry to store your Docker images? Well, look no further! This guide will show you how to set up a self-signed certificate for your Docker registry and make sure it's secure and authenticated.
Before we start, make sure you have the following:
A Linux machine with Docker and Docker Compose installed
A text editor to modify files (e.g., nano or vim)
Let's start by checking if Docker and Docker Compose are already installed on your machine.
# Check if Docker is installed
if ! [ -x "$(command -v docker)" ]; then
echo 'Docker is not installed. Installing...'
# Update the apt package index and install Docker
sudo apt-get update
sudo apt-get install -y docker.io
# Start the Docker service
sudo systemctl start docker
sudo systemctl enable docker
else
echo 'Docker is already installed.'
fi
# Check if Docker Compose is installed
if ! [ -x "$(command -v docker-compose)" ]; then
echo 'Docker Compose is not installed. Installing...'
# Download the Docker Compose binary
sudo curl -L "https://github.com/docker/compose/releases/download/1.28.5/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
# Set the permissions for the Docker Compose binary
sudo chmod +x /usr/local/bin/docker-compose
else
echo 'Docker Compose is already installed.'
fi
If Docker or Docker Compose is not installed, this script will install them for you. If they're already installed, you'll see a message saying so.
Next, let's make sure the current user has the correct permissions to run Docker and Docker Compose.
# Add the current user to the Docker group
sudo usermod -aG docker $USER
# Create the Docker Compose group if it doesn't exist
if ! grep -q "^docker-compose:" /etc/group; then
sudo groupadd docker-compose
fi
# Add the current user to the Docker Compose group
sudo usermod -aG docker-compose $USER
This will add the current user to the Docker and Docker Compose groups so that you can run Docker and Docker Compose commands without having to use sudo.
Now let's generate a self-signed certificate for our Docker registry. This certificate will be used to authenticate the connection between the Docker registry and the Docker client.
#check if any env available then load it
if [ -f .env ]; then
export $(echo $(cat .env | sed 's/#.*//g'| xargs) | envsubst)
fi
# Generate self-signed certificate
ip=$(curl ifconfig.me)
sudo openssl req -newkey rsa:4096 -nodes -sha256 -keyout registry.key -x509 -days 365 -out registry.crt -subj "/CN=docker-registry" -addext "subjectAltName = IP:$ip"
Now that we have all of the prerequisites and permissions set up, we can start our Docker registry. To do this, we will use a Docker Compose file to create and start the registry service.
Here's an example Docker Compose file that starts a Docker registry using the self-signed certificate we generated earlier:
version: '3'
services:
registry:
image: registry:2
ports:
- "${REGISTRY_PORT}:5000"
volumes:
- ./:/certs/
environment:
REGISTRY_HTTP_ADDR: 0.0.0.0:5000
REGISTRY_HTTP_TLS_CERTIFICATE: /certs/registry.crt
REGISTRY_HTTP_TLS_KEY: /certs/registry.key
As we are taking REGISTRY_PORT from an external environment now we have to set up a .env file defining the port. Here is the .env file:
REGISTRY_PORT=6050
To start the Docker registry, save this file as docker-compose.yml and run the following command:
docker-compose up -d
This will start the Docker registry in the background using the self-signed certificate we generated earlier. You can check the status of the registry by running the following command:
docker-compose ps
# Create firewall rule to allow incoming traffic to the Docker registry
sudo ufw allow from any to any port ${REGISTRY_PORT} proto tcp
This will create a firewall rule to allow incoming traffic on the port in the .env file which is 6050 in our case, which is the port the Docker registry is listening on.
To use the self-signed certificate in the Docker client, you'll need to copy the "registry.crt" file to your machine and add it to the list of trusted certificates.
On Windows:
Open Windows Explorer, right-click the certificate registry.crt and choose Install certificate.
Then, select the following options:
Store location: local machine
Check place all certificates in the following store
Click Browser, and select Trusted Root Certificate Authorities
Click Finish
make folder C:/Users/Your_User/.docker/certs.d/<the_remote_machine_ip><port>/
Copy registry.crt and registry.key file from the remote server and paste it here
restart docker
On Linux:
sudo cp registry.crt /usr/local/share/ca-certificates/
sudo update-ca-certificates
sudo cp registry.crt /etc/docker/certs.d/remotemachineip:port/
restart the docker:
sudo systemctl restart docker
You may find this official documentation related to docker certificate setup useful in case anything changes in the future:
Once the certificate is installed, you can test the connection to the Docker registry by running the following command:
docker login https://<ip-of-your-registry>:port
You can either copy all code snippets or clone this repo in the remote machine and can execute all processes related to the remote machine by running the following commands:
git clone https://github.com/syedfahimabrar/privatedockerregistry.git
cd privatedockerregistry
cd project
sudo chmod +x run-registry.sh
./run-registry.sh
In this article, we have shown you how to set up your own private Docker registry using a self-signed certificate. This registry can be used to store your Docker images securely and make them available to your team or projects. You can copy the whole code snippets from this github repo I hope this article has been helpful to you, and that you enjoy your Docker adventure!