AdminSysGNULinux

Outils pour utilisateurs

Outils du site

Piste :
tech:notes_depot_docker_-_docker_registry

Différences

Ci-dessous, les différences entre deux révisions de la page.

Lien vers cette vue comparative

Les deux révisions précédentesRévision précédente
Prochaine révision		Révision précédente
tech:notes_depot_docker_-_docker_registry [2026/02/28 21:57] – Jean-Baptistetech:notes_depot_docker_-_docker_registry [2026/06/07 19:12] (Version actuelle) – modification externe 127.0.0.1
Ligne 1: Ligne 1:
 +<!DOCTYPE markdown>
 +{{tag>Brouillon Docker Redis}}
 +
 +# Notes Dépôt Docker - Docker Registry
 +
 +Voir :
 +* [[Scan de vulnérabilité pour les images de conteneurs]]
 +* https://blog.stephane-robert.info/docs/conteneurs/registres/
 +* https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry
 +* https://docs.oracle.com/en/operating-systems/oracle-linux/podman/registry-private.html#registry_private_secure
 +
 +
 +## Registry (comme JFrog Artifactory)
 +
 +* [Harbor](https://goharbor.io) (cncf.io)
 +* Gitlab registry
 +* <http://port.us.org/>
 +
 +
 +
 +## Public registry
 +
 +Voir :
 +  * https://argocd-image-updater.readthedocs.io/en/stable/configuration/registries/
 +
 +
 +## Configuration
 +
 +Voir :
 +* https://forum.ansible.com/t/running-a-local-container-registry-for-execution-environments/206
 +
 +Voir aussi : 
 +* https://portainer.io/
 +
 +Source :
 +* https://docs.docker.com/registry/
 +
 +** Brouillon, insecure registry**
 +
 +
 +Delete / garbage-collect
 +~~~bash
 +podman exec registry registry garbage-collect --delete-untagged /etc/distribution/config.yml
 +~~~
 +
 +
 +### Client
 +
 +Voir :
 +  * `/etc/containers/registries.conf` et `~/.config/containers/registries.conf`
 +  * https://docs.podman.io/en/v2.2.1/markdown/podman-search.1.html
 +
 +
 +Si http (pas de SSL/TLS) :
 +~~~
 +--tls-verify=false
 +~~~
 +
 +`/etc/systemd/system/docker.service.d/http-proxy.conf`
 +~~~ini
 +[Service]
 +# Environment="HTTP_PROXY=http://192.168.56.1:3128/" "HTTPS_PROXY=http://192.168.56.1:3128/" "NO_PROXY=localhost,127.0.0.0/8,192.168.0.0/16,registry.local"
 +Environment="http_proxy=http://192.168.56.1:3128/" "https_proxy=http://192.168.56.1:3128/" "NO_PROXY=localhost,127.0.0.0/8,192.168.0.0/16,registry.local"
 +~~~
 +
 +~~~bash
 +systemctl daemon-reload
 +systemctl restart docker
 +~~~
 +
 +Vérif
 +~~~bash
 +systemctl show --property=Environment docker
 +~~~
 +
 +`/etc/hosts`
 +~~~
 +192.168.205.18 docker-1
 +~~~
 +
 +API
 +~~~bash
 +curl -X GET -u <user>:<pass> https://myregistry:5000/v2/_catalog
 +curl -X GET -u <user>:<pass> https://myregistry:5000/v2/ubuntu/tags/list
 +~~~
 +
 +
 +#### WebUI
 +
 +~~~bash
 +podman run --rm --network host 
 +    -e REGISTRY_HOSTNAME=127.0.0.1:5000 \
 +    -e REGISTRY_INSECURE=true \
 +    --name docker.io/registry-ui quiq/registry-ui
 +~~~
 +    
 +http://127.0.0.1:8000/
 +
 +
 +#### SSL/TLS
 +
 +~~~bash
 +sudo mkdir -p /etc/docker/certs.d/registry.local:5000
 +~~~
 +
 +Puis déposer le fichier **ca.crt** dans ce dossier.
 +
 +Autre solution 
 +
 +`/etc/docker/daemon.json`
 +~~~javascript
 +{
 +    "log-level":        "error",
 +    "insecure-registries" : ["docker-1.local"],
 +    "proxies": {
 +      "http-proxy": "http://192.168.1.100:3128",
 +      "https-proxy": "https://192.168.1.100:3128",
 +      "no-proxy": "*.local,127.0.0.0/8"
 +  }
 +}
 +~~~
 +
 +Old \\
 +Ne semble plus marcher. \\
 +Avant nous pouvions spécifier un numéro de port au registry Docker.
 +
 +`/etc/docker/daemon.json`
 +~~~javascript
 +{
 +          "insecure-registries" : ["docker-1:5000"]
 +}
 +~~~
 +
 +
 +### Seveur registry
 +
 +~~~bash
 +mkdir docker-registry
 +cd docker-registry
 +
 +mkdir certs
 +openssl req -newkey rsa:4096 -nodes -sha256 -keyout certs/domain.key -x509 -days 365 -out certs/domain.crt
 +
 +chmod a+r certs/domain.*
 +sudo mv certs /certs
 +~~~
 +
 +** Be sure to use the name myregistrydomain.com as a CN **
 +
 +
 +`docker-compose.yml`
 +~~~yaml
 +version: '3'
 +services:
 +  registry:
 +    image: "registry:2"
 +    ports:
 +     - "5000:5000"
 +    environment:
 +     - REGISTRY_HTTP_ADDR=0.0.0.0:5000
 +     - REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt
 +     - REGISTRY_HTTP_TLS_KEY=/certs/domain.key
 +     - REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY=/data
 +     - REGISTRY_STORAGE_DELETE_ENABLED=true
 +    volumes:
 +     - "/certs:/certs"
 +     - "/data:/data"
 +
 +~~~
 +
 +`docker-compose.yml`
 +~~~yaml
 +version: '3'
 +services:
 +  redis:
 +    image: redis
 +    restart: always
 +  registry:
 +    image: "registry:2"
 +    restart: always
 +    ports:
 +     - "5000:5000"
 +    environment:
 +     - REGISTRY_HTTP_ADDR=0.0.0.0:5000
 +     - REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt
 +     - REGISTRY_HTTP_TLS_KEY=/certs/domain.key
 +     - REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY=/data
 +     - REGISTRY_HTTP_SECRET=secret
 +     - REGISTRY_STORAGE_CACHE_BLOBDESCRIPTOR=redis
 +     - REGISTRY_REDIS_ADDR=redis:6379
 +     - REGISTRY_STORAGE_DELETE_ENABLED=true
 +    volumes:
 +     - "/certs:/certs"
 +     - "/data:/data"
 +  registry-ui:
 +    image: konradkleine/docker-registry-frontend:v2
 +    restart: always
 +    ports:
 +     - "80:80"
 +    environment:
 +      VIRTUAL_HOST: '*, https://*'
 +      ENV_DOCKER_REGISTRY_HOST: 'registry'
 +      ENV_DOCKER_REGISTRY_PORT: 5000
 +      ENV_DOCKER_REGISTRY_USE_SSL: 1
 +~~~
 +
 +~~~bash
 +docker-compose up
 +~~~
 +
 +
 +## Utilisation
 +
 +Pull & Push
 +~~~bash
 +docker pull debian:stretch
 +docker tag debian:stretch localhost:5000/debian:stretch
 +docker push localhost:5000/debian:stretch
 +~~~
 +
 +Build & Push
 +~~~bash
 +docker build -t plop . plop registry.local:5000/project/image:tag
 +docker push registry.local:5000/project/image:tag
 +~~~
 +
 +Auth
 +~~~bash
 +docker login registry.local:5000 -u user -p P@sssw0rd
 +~~~
 +
 +### Delete
 +
 +Voir :
 +* https://github.com/docker/distribution/blob/master/docs/spec/api.md
 +* https://stackoverflow.com/questions/25436742/how-to-delete-images-from-a-private-docker-registry
 +* https://lumao.eu/post/gitlab-private-registry-docker/
 +* https://blog.eleven-labs.com/fr/mise-en-place-docker-registry-privee/
 +
 +
 +Afficher les information détaillées sur notre image taguée.
 +~~~bash
 +docker inspect registry.local:5000/hello-world:latest
 +~~~
 +
 +
 +Voir & effacer les versions taguées
 +~~~
 +$ docker image ls registry.local:5000/*
 +REPOSITORY                            TAG                 IMAGE ID            CREATED             SIZE
 +registry.local:5000/my-hello-world4   latest              fce289e99eb9        13 months ago       1.84kB
 +$ docker image rm registry.local:5000/my-hello-world4
 +Untagged: registry.local:5000/my-hello-world4:latest
 +Untagged: registry.local:5000/my-hello-world4@sha256:92c7f9c92844bbbb5d0a101b22f7c2a7949e40f8ea90c8b3bc396879d95e899a
 +~~~
 +
 +Effacer les fichiers sur le dépôt
 +~~~bash
 +sudo rm ./docker/registry/v2/repositories/my-hello-world -rf
 +sudo rm ./docker/registry/v2/repositories/my-hello-world4 ./docker/registry/v2/blobs/sha256/fc/fce289e99eb9* -rf
 +~~~
 + 
 +~~~
 +$ curl -k https://registry.local:5000/v2/_catalog
 +{"repositories":["hello-world"]}
 +$ curl -k https://registry.local:5000/v2/hello-world/tags/list
 +{"name":"hello-world","tags":["latest"]}
 +~~~
 +
 +~~~
 +$ curl -k -v --silent -H "Accept: application/vnd.docker.distribution.manifest.v2+json" -X GET https://registry.local:5000/v2/hello-world/manifests/latest
 +< content-length: 524                                                         
 +<                                                                                                                  
 +{                                                           
 +   "schemaVersion": 2,                          
 +   "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
 +   "config": {                                      
 +      "mediaType": "application/vnd.docker.container.image.v1+json",
 +      "size": 1510,                                  
 +      "digest": "sha256:fce289e99eb9bca977dae136fbe2a82b6b7d4c372474c9235adc1741675f587e"
 +   },                                               
 +   "layers": [                                                       
 +      {                                                     
 +         "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
 +         "size": 977,                                                                                                                                                                                  "digest": "sha256:1b930d010525941c1d56ec53b97bd057a67ae1865eebf042686d2a2d18271ced"                                                 
 +      }
 +   ]
 +* Curl_http_done: called premature == 0
 +~~~
 +
 +~~~bash
 +curl -k -v --silent -H "Accept: application/vnd.docker.distribution.manifest.v2+json" -X DELETE https://registry.local:5000/v2/hello-world/manifests/sha256:fce289e99eb9bca977dae136fbe2a82b6b7d4c372474c9235adc1741675f587e
 +~~~
 +
 +Pour vraiment libérer l'espace \\
 +Lancer à l’intérieur du conteneur 
 +~~~bash
 +bin/registry garbage-collect /etc/docker/registry/config.yml
 +~~~
 +
 +
 +## Client
 +
 +Voir : 
 +  * `podman search`
 +  * `crane` (asdf)
 +  * skopeo
 +
 +https://blog.stephane-robert.info/docs/conteneurs/outils/crane/
 +
 +
 +~~~bash
 +skopeo inspect docker://tomsquest/docker-radicale | jq
 +
 +podman search --list-tags docker.io/library/centos --limit 5
 +
 +skopeo list-tags docker://docker.io/library/centos
 +~~~
 +
 +Autres
 +~~~bash
 +oras manifest fetch docker.io/library/alpine:latest
 +
 +oras repo list localhost:5000
 +oras repo tags localhost:5000/config/nginx
 +~~~
 +
 +
 +### Pb 
 +
 +#### Error "server gave HTTP response to HTTPS client"
 +
 +~~~bash
 +podman exec -ti kind-control-plane /bin/bash
 +ctr -n k8s.io image pull --plain-http=true registry.test.svc.cluster.local:5000/awx-ee-gts-it:2.19.3-2-1
 +~~~
 +
  
Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki