Setup secure Docker Registry with Nginx and SSL

Prerequisites

  1. Docker v1.12 installed. (though you could try it with lower version)
  2. Docker Compose v1.6 installed.
  3. apache2-utils are installed.
  4. Ubuntu (but it very similar for other distro).
  5. A domain name to run the docker registry. (a subdomain would work too).
  6. SSL certificate for the domain to run the docker registry on.

Step 1: create docker-compose.yml

Create a directory registry and under it create a docker-compose.yml.

This docker-compose file create a registry container using the registry:2 image and also a front-end proxy using the nginx:1.10.1 image.

The registry container is configured to expose it's port 5000 to other container that links to it (in this case, the proxy container can access the registry via that port)

The proxy container is configured to listen to port 80 and 443 on the host. Other nginx configuration are stores under the conf.d directory that are mapped as volume.


REGISTRY_HTTP_SECRETSet a secret text for the http header. You can put any text you want.
Volumes Set the path to both your SSL cert and key.

The file also refer to `config.yml`, `conf.d` and `html` which we're going to create later

Step 2: create config.yml

Under the same registry directory. create a config.yml file.

The config.yml configure how the docker registry needs to be setup to run. In this configuration, I setup the registry to use the local file system as the storage. It can be configured to use other storage engine, e.g. this one configures it to use Azure Blob Storage https://gist.github.com/kwokhou/f20defbfc34b1bf86c6e6e9e6aa7fda4 

Full list of the configuration can be found here.

Step 3: create proxy.conf

Create a subdirectory nginx and under it create a file proxy.conf.  The nginx is configured to upstream the traffic to the docker registry on port 5000, and it is also configured to perform basic authentication via the htpasswd file (next step)

Remember to change the server_name.

 Step 4: create basic authentication file htpasswd

 Finally, create a htpasswd file under the nginx directory.

Once apache2-utils installed (sudo apt-get install apache2-utils on Ubuntu). Run htpasswd -c htpasswd john under the nginx directory, to create an access for john.

Comments

Post a Comment

Popular posts from this blog

Generating INSERT statement from SELECT using SQuirreL SQL

Image
There are often time during development where you would want to test your application with various type of sample data, and you would want those data to be share with other team member as well. The scenario that I ran into recently is we have some sample data that was enter to a system through a web interface, and for reports developments purposes we need those data to be shared among the team members, so we start to look into exporting those data out using SQL SELECT statements (with the correct WHERE clause) then converting them to equivalent INSERT statement; there are of cause several ways to do this, but I prefer the easy way, using SQuirreL SQL . The insert script can them be shared among the team members. Following is the steps for completing this Install  SQuirreL SQL Make sure you have  JRE7  installed on your machine Create connection to you database Depending on your database type you need to use different drivers Create the Alias to your database and enter
Read more

OneNote: We need the password to sync this notebook (Error code: 0xE4010643)

Image
It happen to me once and it happen to me twice, and it happen again this morning. When I saw this message, I knew no mater how many times I hit the "Sync All" it will never goes through (but I did it anyway). I found these happen to me if I leave OneNote open, and put the computer to hibernate / sleep mode. Somehow when the computer awake from sleep, OneNote will failed to sync due to the credentials is out of sync.  To avoid this I always close OneNote before putting the computer to sleep and often I simple shutdown the computer. The fix to this is simply delete the cached credential used by OneNote to connect to server for synchronization, and re-login. To do this, follow the following steps ( Make sure you close OneNote before you proceed) : Go to "Control Panel" > "User Accounts and Family Safety" Click "Credential Manager" Click "Manage Windows Credentials" Look for "MicrosoftOffice15_Data:live:c
Read more

Built-in UITableViewCell's Styles (UITableViewCellStyle)

Image
UITableView has some built-in styles which can be use with in most scenario. You might want to look into these styles before starting to built a customize TableViewCell. There are 4 types of styles for the UITableViewCell , enum representation of this is UITableViewCellStyle . The details is as follow:   UITableViewCellStyleDefault , Default style with label on the left.    UITableViewCellStyleValue1 , Label on the left, and a blue label on the right.    UITableViewCellStyleValue2 , Blue label on the left side (right aligned text), label on the right side (left aligned text).    UITableViewCellStyleSubtitle , This is almost same with the Default style except that it has a grey smaller text under the label. It functions as the description / subtitles. To change the default style of a  UITableViewCell , replace the styles enum in initWithStyle with any of the enum mentioned above, simple as that. Example: // ObjC version - (UITableViewCell * ) tableView: (U
Read more