Setup secure Docker Registry with Nginx and SSL

Prerequisites

  1. Docker v1.12 installed. (though you could try it with lower version)
  2. Docker Compose v1.6 installed.
  3. apache2-utils are installed.
  4. Ubuntu (but it very similar for other distro).
  5. A domain name to run the docker registry. (a subdomain would work too).
  6. SSL certificate for the domain to run the docker registry on.

Step 1: create docker-compose.yml

Create a directory registry and under it create a docker-compose.yml.

This docker-compose file create a registry container using the registry:2 image and also a front-end proxy using the nginx:1.10.1 image.

The registry container is configured to expose it's port 5000 to other container that links to it (in this case, the proxy container can access the registry via that port)

The proxy container is configured to listen to port 80 and 443 on the host. Other nginx configuration are stores under the conf.d directory that are mapped as volume.


REGISTRY_HTTP_SECRETSet a secret text for the http header. You can put any text you want.
Volumes Set the path to both your SSL cert and key.

The file also refer to `config.yml`, `conf.d` and `html` which we're going to create later

Step 2: create config.yml

Under the same registry directory. create a config.yml file.

The config.yml configure how the docker registry needs to be setup to run. In this configuration, I setup the registry to use the local file system as the storage. It can be configured to use other storage engine, e.g. this one configures it to use Azure Blob Storage https://gist.github.com/kwokhou/f20defbfc34b1bf86c6e6e9e6aa7fda4 

Full list of the configuration can be found here.

Step 3: create proxy.conf

Create a subdirectory nginx and under it create a file proxy.conf.  The nginx is configured to upstream the traffic to the docker registry on port 5000, and it is also configured to perform basic authentication via the htpasswd file (next step)

Remember to change the server_name.

 Step 4: create basic authentication file htpasswd

 Finally, create a htpasswd file under the nginx directory.

Once apache2-utils installed (sudo apt-get install apache2-utils on Ubuntu). Run htpasswd -c htpasswd john under the nginx directory, to create an access for john.

Comments

Post a Comment

Popular posts from this blog

Generating INSERT statement from SELECT using SQuirreL SQL

Image
There are often time during development where you would want to test your application with various type of sample data, and you would want those data to be share with other team member as well. The scenario that I ran into recently is we have some sample data that was enter to a system through a web interface, and for reports developments purposes we need those data to be shared among the team members, so we start to look into exporting those data out using SQL SELECT statements (with the correct WHERE clause) then converting them to equivalent INSERT statement; there are of cause several ways to do this, but I prefer the easy way, using SQuirreL SQL . The insert script can them be shared among the team members. Following is the steps for completing this Install  SQuirreL SQL Make sure you have  JRE7  installed on your machine Create connection to you database Depending on your database type you need to use different drivers Create the Alias to your database and enter
Read more

OneNote: We need the password to sync this notebook (Error code: 0xE4010643)

Image
It happen to me once and it happen to me twice, and it happen again this morning. When I saw this message, I knew no mater how many times I hit the "Sync All" it will never goes through (but I did it anyway). I found these happen to me if I leave OneNote open, and put the computer to hibernate / sleep mode. Somehow when the computer awake from sleep, OneNote will failed to sync due to the credentials is out of sync.  To avoid this I always close OneNote before putting the computer to sleep and often I simple shutdown the computer. The fix to this is simply delete the cached credential used by OneNote to connect to server for synchronization, and re-login. To do this, follow the following steps ( Make sure you close OneNote before you proceed) : Go to "Control Panel" > "User Accounts and Family Safety" Click "Credential Manager" Click "Manage Windows Credentials" Look for "MicrosoftOffice15_Data:live:c
Read more

Fixing the AKE BC398 USB3.0 sluggish performance

Image
Recently I've got myself a ExpressCard USB 3.0 controller ( AKE BC398 USB3.0 Card) from ebay for my almost 5 years old Lenovo T400 (amazing machine, it seem to last forever). AKE BC398 ExpressCard The card only cost me around USD $12 from ebay. Installing the card was a piece of cake; just eject the plastic piece from the ExpressCard slot and slot the card in; it fit nicely. It is a 54mm type. 1st think I tried after installing the hardware is plug my USB 3 portable hard drive ( Seagate FreeAgent ) in and copy a large file (a openSUSE iso file ~4.5GB) to the computer's desktop. To my surprise, the speed was slow, I mean snail slow! Even slower then my USB 2 port ~ 10 MB/s. I unplug the portable drive and plug the drive to my USB 2.0 port and it has ~30MB/s speed, copying the same file. After trying with several trick, plug or unplug, give it an external power, driver updates, and even reformat my Seagate FreeAgent drive, but nothing seem to work. I turn to Google
Read more