Setup secure Docker Registry with Nginx and SSL

on


Prerequisites



  1. Docker v1.12 installed. (though you could try it with lower version)

  2. Docker Compose v1.6 installed.

  3. apache2-utils are installed.

  4. Ubuntu (but it very similar for other distro).

  5. A domain name to run the docker registry. (a subdomain would work too).

  6. SSL certificate for the domain to run the docker registry on.


Step 1: Create docker-compose.yml


mkdir registry && cd registry && touch docker-compose.yml

Create a directory registry and under it create a docker-compose.yml.



In this docker-compose file, I'm creating a container using the registry:2 image (and call it registry). The registry:2 image is the official Docker Registry image for setting up a Docker Registry.

image:registry:2

I also setting up a front-end proxy using the nginx:1.10.1 image.

Other things to note is, I set the restart:always flag to the container so that in case of the server reboots, the container will be restarted.

Exposing Ports from Container


The registry container is configured to expose it's port 5000 to other container that links to it (in this case, the proxy container can access the registry via that port)

The proxy container is configured to listen to port 80 and 443 on the host.

Other Nginx configuration are stores under the conf.d directory and we're mapping it to the host.

Mapping the location of SSL certificate


I'm setup the Nginx to use SSL, so I just need to map the location to the SSL certificate and private key on the host to the location of certs Nginx is expecting in the container. When nginx starts, it will load the certs from within the container.

Note: I found out it's actually easier to just use a valid certificate instead of using a self-signed certificate, because for the later to work, I have to inject the root cert to all docker daemon that's going to access the registry.
REGISTRY_HTTP_SECRET:Set a secret text for the http header. You can put any text you want.
Volumes: Set the path to both your SSL cert and key.

The docker-compose file is referencing and external `config.yml`, `conf.d` and `html` files and directory. We're going to create them in the next step.

Step 2: Create config.yml


Under the same registry directory. create a config.yml file.

The config.yml configure how the docker registry needs to be setup to run. In this configuration, I setup the registry to use the local file system as the storage. It can be configured to use other storage engine, Here's an example on using Azure Blog Storage and Amazon S3



Full list of the storage configuration can be found here

Step 3: Create proxy.conf


Create a subdirectory nginx and under it create a file proxy.conf.  The nginx is configured to upstream the traffic to the docker registry on port 5000, and it is also configured to perform basic authentication via the htpasswd file (next step)

Remember to change the server_name.

Step 4: Create basic authentication file htpasswd


Finally, create a htpasswd file under the nginx directory.
Once apache2-utils installed (sudo apt-get install apache2-utils on Ubuntu).

Run htpasswd command under the nginx directory, to create an access for john.
htpasswd -c htpasswd john

Comments

Post a Comment