Can we change kubernetes image registry search list? - docker

For example, I have an internal docker registry for my kube cluster, hosted on internal-docker-registry.io:5000.
When the pod from the kube cluster pulling image busybox, I don't want to pull from docker hub docker.io. But instead I want it to pull from internal-docker-registry.io:5000.
Note that I cannot change the image name to internal-docker-registry.io:5000/busybox since I don't own the spec and there are too man these kind of third party image in my cluster.

I have posted community wiki answer to summarize the topic:
As David Maze well mentioned in the comment:
there is no "image registry search list"; an image name without a registry always uses docker.io, to avoid surprises where e.g. FROM ubuntu means something different depending on local configuration.
So if you can't change the image name to internal-docker-registry.io:5000/busybox then unfortunately you don't have the option to get the image from your private registry (according to David's comment).
See also similar questions:
How to change the default docker registry from docker.io to my private registry?
How to change default K8s cluster registry?

Here you can find a complete guide on how to accomplish this in the official kubernetes documentation [1]
[1] https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/

Related

How to get transferable docker compose stack without dockerhub

I have few docker images composed together in the stack using docker-compose.yml.
Now I want to transfer whole docker compose stack to the other host machine without uploading to the dockerhub,
And deploy it on the docker swarm.
I saw there is a thing called docker compose bundle, would that help?
If you’re deploying on a multi-host swarm (or something similar like Kubernetes or Nomad) you all but need a Docker registry. It doesn’t specifically have to be Docker Hub — quay.io, Amazon’s ECR, Google’s GCR, and self-hosted registries all work fine — but you do need to have pushed the built images somewhere where the orchestrator can retrieve them by name.
I’ve never used docker-compose bundle myself, but its documentation also notes that its operation “requires interaction with a Docker registry”.
The only real alternative is using docker save and docker load to manually move images between machines, but as a manual process it will get tedious very quickly, and you need to make sure an identical set of images are on every machine for consistency. Using a registry will be vastly easier.
The easyest way to do it is to use a Docker registry. The problem with Docker Hub is that you can only have one private registry, the rest must be public or paid.
Thankfully, there are other (free) alternatives:
Deploy your own private registry. Here is a nice tutorial where you can try it in the browser.
Use a free private registry. I personnaly use Codefresh. It can automatically build your image from a private repo (like bitbucket who has free plan too), but you can also just use it like a "simple" docker registry and push and pull your Docker images there.

Controlling access to docker registry with Sonatype nexus

In our current setup we are do proxy to entire docker hub to pull the images, but what we want is limit this proxy to only official indexes like ubuntu, apache etc.
During configuration of repository there was this option to set custom index for the repository, so my two questions are :
With this custom index option will I be able to achieve what I explained above?
If yes, then from where I should get the URL for custom index. so far I tried using https://hub.docker.com/_/centos/ for centos but it didn't worked.
Please suggest how to go about this.
Yes, you can use a custom index to limit what's available in your repo. To achieve that you have to deploy and maintain your own docker registry index service and use that when configuring your docker proxy repository.
However, an easier solution would be to use a content selector to limit what's allowed to be access via your docker proxy repository while still using Docker Hub with it's original index.
Using the simplified content selector solution is a bit hacky, but might work for you. Essentially you have to provide a whitelist (or a blacklist) in a form of a regex. The implication of this solution is that users of your registry will still be able to search for any available image, because you can keep using the Docker Hub's index for simplicity.
Create a docker proxy repository pointing to the Docker Hub.
Create a content selector with a white/black list of images, eg. path =~ '^/v2/library/(alpine|ubuntu).*$' will only allow alpine and ubuntu to be downloaded.
Create a new privilege of type Repository Content Selector.
Create a role containing the above privilege.
Create a user with an above role.
Now, the user you have created shall log into your registry, eg. $ docker login nexus.local:8085. That user will be authorised to pull both alpine and ubuntu (based on the content selector from step 2), but will fail to download anything else.
A sample succesful pull:
$ docker pull nexus.local:8085/alpine
Using default tag: latest
latest: Pulling from alpine
Digest: sha256:0873c923e00e0fd2ba78041bfb64a105e1ecb7678916d1f7776311e45bf5634b
Status: Image is up to date for nexus.local:8085/alpine:latest
A sample failed pull:
$ docker pull nexus.local:8085/postgres
Using default tag: latest
Error response from daemon: unauthorized: access to the requested resource is not authorized
we are do proxy to entire docker hub to pull the images, but what we want is limit this proxy to only official indexes like ubuntu, apache
What I did was:
Create a routing rule
Mode: ALLOW
I wanted only alpine and centos so I created two matches with:
^/v2/library/centos.*$
^/v2/library/alpine.*$
Go to configuration of the docker proxy repository
Go to Routing Rule
And pick the routing rule you created.
That way all except centos and alpine are available from that docker proxy repo. Pulling anything else results in "manigest unknown" error from docker.

how to restrict docker to pull/push to specific registry

Is there a way to pull docker images from your own registry without providing the registry name
something like
docker pull alpine should pull my image from docker pull docker-myorganisation.com/alpine
This isn't possible, the reason is that it would break the global namespace, which makes sense if you think about it, imagine the following Dockerfile:
FROM debian:latest
...
Would this refer to debian:latest on the official registry, or your own registry?
If you could willingly set your own default registry, the answer would be:
It depends.
This would lead to all kinds of breakage when the author of the file assumes it will be official registry, but your settings say different.
This is currently not supported.
See also: Github

Is docker phasing out some sites and services or something?

Aim: to deploy a private registry
Discussion
private repository
I have read multiple posts and now I am confused. I have tried to run a docker container that should serve a private docker registry, but it returns an empty UI. Some posts indicate that it has been deprecated, but some other do not.
images
I used to navigate to dockerhub, but now there is https://store.docker.com?
Questions
Has docker registry been phased out?
Should one now use https://store.docker.com in stead of docker hub?
Docker hub still exists and will remain for the open source projects as it always has.
Docker store is a new offering for commercial images.
The standalone registry does not have a UI, don't believe it ever has. It's intended to be accessed with docker push and docker pull commands.

Difference between Docker registry and repository

I'm confused as to the difference between docker registries and repositories. It seems like the Docker documentation uses the two words interchangeably. Also, repositories are sometimes referred to as images, such as this from their docs:
In order to push a repository to its registry, you need to have named
an image or committed your container to a named image as we saw here.
Now you can push this repository to the registry designated by its
name or tag.
How can you push a repository to a registry? Aren't you pushing the image to the repository?
Docker registry is a service that is storing your docker images.
Docker registry could be hosted by a third party, as public or private registry, like one of the following registries:
Docker Hub,
Quay,
Google Container Registry,
AWS Container Registry
or you can host the docker registry by yourself
(see https://docs.docker.com/ee/dtr/ for more details).
Docker repository is a collection of different docker images with same name, that have different tags. Tag is alphanumeric identifier of the image within a repository.
For example see https://hub.docker.com/r/library/python/tags/. There are many different tags for the official python image, these tags are all members of the official python repository on the Docker Hub. Docker Hub is a Docker Registry hosted by Docker.
To find out more read:
https://docs.docker.com/registry/
https://github.com/docker/distribution
From the book Using Docker, Developing and deploying Software with Containers
Registries, Repositories, Images, and Tags
There is a hierarchical system for storing images.
The following terminology is used:
Registry
A service responsible for hosting and distributing images. The default registry is the Docker Hub.
Repository
A collection of related images (usually providing different versions of the same application or service).
Tag
An alphanumeric identifier attached to images within a repository (e.g., 14.04 or stable ).
So the command docker pull amouat/revealjs:latest will download the image tagged latest within the amouat/revealjs repository from the Docker Hub registry.
Complementing the information:
You usually push a repository to a registry (and all images that are part of it). But you can push a single image to a registry. In all cases, you use docker push.
An image has a 12-hex-digit Image ID, but is also identified by: namespace/repo-name:tag
The image full name can be optionally prefixed by the registry host name and port: myregistryhost:5000/namespace/repo-name:tag
A common naming convention is to use your registry user-name as what I called "namespace".
A docker repository is a cute combination of registry and image.
docker tag foo <registry>/<image>:<tag>
is the same as
docker tag foo <repository>:<tag>
Docker Registry is a service, which you can either host yourself (Trusted and Private) or you can let docker hub be the host for this service. Usually, if your software is commercial, you will have hosted this as a "Private and Trusted" registry. For Java Developers, this is somewhat analogous to Maven Artifactory setup.
Docker Repository is a set of "Tagged" images. An example is that you might have tagged 5 of ubuntu:latest images:
a) Nano editor (image1_tag:v1)
b) A specific software 1 (image1_tag:v2)
c) Sudo (image1_tag:v3)
d) apache http daemon (image1_tag:v4)
e) tomcat (image1_tag:v5)
You can use docker push command to push each of the above images to your repository. As long as the repository names match, they will be pushed successfully, and appear under your chosen repository and correctly tagged.
Now, your question is, "So where is this repository hosted/who is managing the service"? That is where Docker Registry comes into picture. By default you will get a docker hub registry (Open Source) which you can use to keep your private/public repository. So without any modification, your images will be pushed to your private repository in docker hub. An example output when you pushing your image tags are the following:
docker#my-docker-vm:/$ docker push mydockerhub/my-helloworld-repo:my_tag
The push refers to repository [docker.io/mydockerhub/my-helloworld-repo]
bf41e934d39d: Pushed
70d93396f87f: Pushed
6ec525dfd060: Pushed
705419d10b13: Pushed
a4aaef726d02: Pushed
04964fddc946: Pushed
latest: digest: sha256:eb93c92351bce785aa3ec0de489cfeeaafd55b7d90adf95ecea02629b376e577 size: 1571
docker#my-docker-vm:/$
And if you type immediately docker images --digests -a you can confirm that your pushed image tags are now showing new signature against the private repository managed by docker hub registry.
A Docker image registry is the place to store all your Docker images. The image registry allows you to push and pull the container images as needed.
Registries can be private or public. When the registry is public, the images are shared with the whole world whereas in the private registry the images are shared only amongst the members of an enterprise or a team.
A registry makes it possible for the Docker daemon to easily pull and run your Docker images.
Docker Hub and other third party repository hosting services are called “registries”. A registry stores a collection of repositories.
As a registry can have many repositories and a repository can have many different versions of the same image which are individually versioned with tags.
The confusion starts with this definition of a tag: "An alphanumeric identifier attached to images in a repository"
I'd rather call that alphanumeric identifier that you append with a ':' a tag-suffix for now. When somebody says "'latest' is the default tag", then this kind of tag-suffix is meant.
In reality, the :latest' suffix is technically part of the tag. The entire name is a tag. All these are tags (possibly referring to the same image):
myimagename
myimagename:latest
username/theirimagename:1.0
myrepo:5000/username/imagename:1.0
(I say imagename here, just to illustrate the other main source of confusion. That's the repositoryname, of course. Sorry.)
Examples:
a) When you want to name your image while building, you use docker build -t thisname ... -- that is -t for tag, (not -n for name).
b) When you want to push that image to a registry, you need to have the full URL (starting with registryname and ending with a tag-suffix) as a tag:
docker tag thisname mylocalregistry:5000/username/repoimagething:1.0
Now you push the image known as thisname by saying:
docker push mylocalregistry:5000/username/repoimagething:1.0
Naming things is hard.
Alas! A repository is not a "container" (aaargh...) where you put things in, that is what muggles think...

Resources