Can you have a Docker registry with credentials? - docker

Question

Assume I am running a docker registry at example.com, i would pull down images by:
docker pull example.com:5000/image:1
How can I password protect this registry? It might contain confidential code/data.

Answer 1

This is mentioned in the official documentation. There are several ways to secure a Docker registry. Note that all of them will only work with a TLS-secured registry (otherwise you'd be sending password or other credentials in plain-text, which would not add any security).
Authentication within the registry itself
Start by creating a credentials file in htpasswd format:
$ htpasswd -Bbn testuser testpassword > auth/htpasswd
Then mount this file into your registry container and pass the REGISTRY_AUTH_HTPASSWD_* environment variables:
$ docker run -d -p 5000:5000 --restart=always --name registry \
-v `pwd`/auth:/auth \
-e "REGISTRY_AUTH=htpasswd" \
-e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" \
-e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \
-v `pwd`/certs:/certs \
-e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt \
-e REGISTRY_HTTP_TLS_KEY=/certs/domain.key \
registry:2
Proxy authentication
Use a reverse proxy (like Nginx) running on the host or another container to handle authentication (documented in-depth here):
upstream docker-registry {
server registry:5000;
}
server {
listen 443 ssl;
server_name myregistrydomain.com;
ssl_certificate /etc/nginx/conf.d/domain.crt;
ssl_certificate_key /etc/nginx/conf.d/domain.key;
client_max_body_size 0;
location /v2/ {
auth_basic "Registry realm";
auth_basic_user_file /etc/nginx/conf.d/nginx.htpasswd;
proxy_pass http://docker-registry;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 900;
}
}
External authentication with token server
As you've mentioned username/password protections, one of the solutions above will probably be sufficient for you. For completeness, you can also use authentication with an external authentication provider. The interface that a token server needs to implement is specified here, with the necessary configuration options being described here.