01 Oct 2017 / 2 min read

Private Docker Registry

In this guide we'll see how to start a private docker registry. The perfect place to store all the images of projects you don't want to make public on…

> Archived article from 2017, from the old nutellino.it: commands and versions may be out of date.

> Machine translation from Italian: the original is here.

# archive# docker

.archive-gate.is-locked .archive-gated{filter:none;pointer-events:auto;user-select:auto;max-height:none;-webkit-mask-image:none;mask-image:none}.archive-backdrop,.archive-dialog{display:none}

Hi everyone!

In this guide we'll see how to start a private docker registry.
The perfect place to store all the images of projects you don't want to make public on hub.docker.com.

Let's start from this project I uploaded to github: https://github.com/nutellinoit/docker-registry-letsencrypt

I used 3 containers:

An official docker container to run the registry, version 2.6.2.
A container that runs let's encrypt and automatically creates the https certificate for our registry.
A container that exposes a web browser for it, using the project at https://hub.docker.com/r/hyper/docker-registry-web/

The whole project structure is written in the docker-compose.yml, which holds the docker infrastructure to start the solution.

yaml

version: '2'
services:
  registry:
    restart: always
    image: registry:2.6.2
    environment:
      REGISTRY_HTTP_TLS_CERTIFICATE: /certs/live/${REGISTRY_DOMAIN}/fullchain.pem
      REGISTRY_HTTP_TLS_KEY: /certs/live/${REGISTRY_DOMAIN}/privkey.pem
    volumes:
      - ${REGISTRY_DATA}:/var/lib/registry
      - ${LETSENCRYPT_PATH}/:/certs
    networks:
      - registry-net

  lets-nginx:
    build: ./lets-nginx/
    restart: always
    volumes:
      -  ${LETSENCRYPT_CACHE}:/cache
      -  ${LETSENCRYPT_PATH}:/etc/letsencrypt
      - ${HTACCESS_REGISTRY}:/etc/nginx/password_registry
    links:
      - registry
    environment:
      EMAIL: ${REGISTRY_EMAIL}
      DOMAIN: ${REGISTRY_DOMAIN}
      UPSTREAM: registry:5000
    ports:
      - ${HTTP_PORT}:80
      - ${HTTPS_PORT}:443
    networks:
      - registry-net

  registry-web:
      image: hyper/docker-registry-web:v0.1.2
      ports:
        - ${REGWEB_HTTP_PORT}:8080
      volumes:
         - ${REGWEB_CONF}/registry-web:/conf:ro
         - ${REGWEB_DB}:/data
      depends_on:
        - registry
      networks:
        - registry-net
networks:
  registry-net:

As you can see, everything is driven by environment variables, to make starting this registry as customizable as possible.

All you need to do is copy the two example files (.env.example and password_registry_example) to their counterparts covered by .gitignore

bash

cp .env.example .env
cp password_registry_example password_registry

Now we can edit both password_registry and .env . The password file is easy to edit using http://www.htaccesstools.com/htpasswd-generator/

As for the .env file, here's its structure:

bash

# Let's encrypt data path

# folders
LETSENCRYPT_CACHE=./cache
LETSENCRYPT_PATH=./letsencrypt
# file
HTACCESS_REGISTRY=./password_registry

# Ports

HTTP_PORT=80
HTTPS_PORT=443

# Registry data path

# folders
REGISTRY_DATA=./datalocal
# config
REGISTRY_DOMAIN=registry.domain.tld
REGISTRY_EMAIL=demo@domain.tld

# Registry web browser data path

# folders
REGWEB_CONF=./conf
REGWEB_DB=./db
# Ports
REGWEB_HTTP_PORT=8080

You can leave everything as is except for two parameters:

REGISTRY_DOMAIN, which will hold the domain name of our registry
REGISTRY_EMAIL, which will hold the email address of the domain's owner

Once these changes are done we can go ahead and start everything with

bash

docker-compose up -d

Since issuing the certificate will take a while, we'll probably have to stop and restart the solution a couple of times. In the end, though, we'll have our registry up and running!

Here's a short video of starting and logging into a test registry: