Ana içeriğe geç

Private Registry Installation

Use this guide when you want to set up your own private registry, pull images from the internet and push them to your local environment, or load from a .tar file. If you use corporate Nexus or Harbor, see Nexus Usage or Harbor Usage.

Info

The docker distribution package is available in the extras repository on CentOS 7.4. If it is disabled on your CentOS 7 system, you may need to enable it.

Registry Installation on CentOS 7​

Docker Distribution installation

Install the Docker Distribution package:

sudo yum -y install docker-distribution
Configuring Docker Registry

The Docker registry configuration file is located at /etc/docker-distribution/registry/config.yml. It is in YAML format. If you need to make any changes, do so here.

Example configuration file:

version: 0.1
log:
  fields:
    service: registry
storage:
  cache:
    layerinfo: inmemory
  filesystem:
    rootdirectory: /var/lib/registry
http:
  addr: :5000
Info

From the default configuration file:

  • /var/lib/registry: Directory where Docker images will be stored
  • Service: Binds to port 5000 on all network interfaces
SELinux and Firewall configuration
Warning

If you have enabled SELinux, you may encounter an issue when using port 5000. Consider disabling SELinux or setting it to permissive mode if you encounter problems.

If the firewall is enabled and running, allow the port in the firewall:

firewall-cmd --add-port=5000/tcp
firewall-cmd --reload
Starting Docker Registry

Start the service and set it to start on boot:

systemctl start docker-distribution
systemctl enable docker-distribution

Verify that the Docker distribution service is running:

systemctl status docker-distribution

Example output:

● docker-distribution.service - v2 Registry server for Docker
   Loaded: loaded (/usr/lib/systemd/system/docker-distribution.service; disabled; vendor preset: disabled)
   Active: active (running) since Sat 2018-03-31 14:31:16 EDT; 2min 20s ago
 Main PID: 16262 (registry)
   CGroup: /system.slice/docker-distribution.service
           └─16262 /usr/bin/registry serve /etc/docker-distribution/registry/...

Configuring Registry Access on Nodes​

By default, container runtimes connect to the registry over HTTPS. If you are on a trusted network, you can use an insecure registry. This eliminates the need for a CA-signed certificate for internal use.

Apply this configuration on all nodes that will pull images from the registry. Select the tab matching the container runtime used on your nodes.

Switch to the root user and open the configuration file:

sudo su
vi /etc/containerd/config.toml

Add the registry definition under [plugins."io.containerd.grpc.v1.cri".registry]. If the registry is served over HTTP, the endpoint starts with http://:

[plugins."io.containerd.grpc.v1.cri".registry.mirrors."dockerregistry.local:5000"]
  endpoint = ["http://dockerregistry.local:5000"]

Restart the containerd service to apply the change:

systemctl restart containerd
systemctl status containerd

Hostname Definition​

If you don't have a DNS server, use the /etc/hosts file to map the hostname to an IP address:

cat /etc/hosts
192.168.X.X dockerregistry.local
Note

If a hostname is used, it must also be defined in the host files of the other machines in the Kubernetes cluster.

Docker Registry Usage​

Follow the steps below to upload and manage images to the Private Docker Registry.

Downloading image

Download images to the environment where Docker registry is installed:

docker pull apinizercloud/apimanager:<APINIZER_VERSION>
Tagging image

Tag the image as dockerregistry.local:5000/apinizercloud/apimanager:<APINIZER_VERSION>. This creates an additional tag for the existing image:

docker tag apinizercloud/apimanager:<APINIZER_VERSION> dockerregistry.local:5000/apinizercloud/apimanager:<APINIZER_VERSION>
Info

When the first part of the tag is a hostname and port, Docker interprets this as the location of a registry during push.

Pushing image to registry

Push the image to the local registry:

docker push dockerregistry.local:5000/apinizercloud/apimanager:<APINIZER_VERSION>
Info

If the image upload was successful, you should get a sha256 hash at the end. Transferred images are stored under the /var/lib/registry/docker/registry/v2/repositories directory.

Repository check

Check the transferred images:

ls /var/lib/registry/docker/registry/v2/repositories

Repeat the same steps for the other components (worker, cache, integration, apiportal). To load all components at once, you can use the automatic image loading script below.

Loading Image from .tar File​

Loading an Apinizer image received as .tar to registry:

docker image load < apinizercloud-apimanager.tar
docker tag apinizercloud/apimanager:<APINIZER_VERSION> dockerregistry.local:5000/apinizercloud/apimanager:<APINIZER_VERSION>
docker push dockerregistry.local:5000/apinizercloud/apimanager:<APINIZER_VERSION>

Adding Images to Local Docker Registry with Linux Shell Script​

Automatic Image Loading Script​

You can use the following script to automatically load Apinizer images to local Docker registry:

vi pullApinizerImages.sh

Script content:

#!/bin/bash

localRepositoryUrl=dockerregistry.local:5000

if [ $# -eq 0 ]; then
  echo "Please enter the version information as a parameter."
  exit
fi

echo "Your Local Repository Url : $localRepositoryUrl"
echo "Version = $1"
version=$1

docker pull apinizercloud/apimanager:"$version"
docker tag apinizercloud/apimanager:$version $localRepositoryUrl/apinizercloud/apimanager:$version
docker push $localRepositoryUrl/apinizercloud/apimanager:$version

docker pull apinizercloud/worker:$version
docker tag apinizercloud/worker:$version $localRepositoryUrl/apinizercloud/worker:$version
docker push $localRepositoryUrl/apinizercloud/worker:$version

docker pull apinizercloud/cache:$version
docker tag apinizercloud/cache:$version $localRepositoryUrl/apinizercloud/cache:$version
docker push $localRepositoryUrl/apinizercloud/cache:$version

docker pull apinizercloud/integration:$version
docker tag apinizercloud/integration:$version $localRepositoryUrl/apinizercloud/integration:$version
docker push $localRepositoryUrl/apinizercloud/integration:$version

docker pull apinizercloud/apiportal:$version
docker tag apinizercloud/apiportal:$version $localRepositoryUrl/apinizercloud/apiportal:$version
docker push $localRepositoryUrl/apinizercloud/apiportal:$version

echo "Image pull operation completed."

Usage:

sh pullApinizerImages.sh <APINIZER_VERSION>

Registry API Usage​

Querying Catalog Information​

To list all repositories in the registry:

curl http://dockerregistry.local:5000/v2/_catalog

Example output:

{
  "repositories": [
    "apinizercloud/apimanager",
    "apinizercloud/worker",
    "apinizercloud/cache",
    "apinizercloud/integration",
    "apinizercloud/apiportal"
  ]
}

Listing Image Tags​

To list tags of a specific image:

curl http://dockerregistry.local:5000/v2/apinizercloud/apimanager/tags/list

Example output:

{
  "name": "apinizercloud/apimanager",
  "tags": [
    "<APINIZER_VERSION>"
  ]
}

Kubernetes Deployment Configuration​

To use private registry in Apinizer deploy files in Kubernetes:

image: dockerregistry.local:5000/apinizercloud/apimanager:<APINIZER_VERSION>

The same path pattern is used for the other components (worker, cache, integration, apiportal).

Repository Cleanup​

To delete images in the repository:

cd /var/lib/registry/docker/registry/v2/repositories
sudo rm -rf *
Note

Another issue to consider when installing Local Docker Registry is SSL.

For more information: https://github.com/Juniper/contrail-docker/wiki/Configure-docker-service-to-use-insecure-registry

Cleaning Unused Images​

To clean unused images:

docker image prune -a
En son tarihinde güncellendi