I just read the entire docs on securing a private Docker Registry. In addition to this, there seems to be a "Docker Trusted Registry", which is described as:
Docker Trusted Registry (DTR) lets you run and manage your own Docker image storage service, securely on your own infrastructure behind your company firewall.
Furthermore, the doc goes on to list a DTRs features:
An image registry to store, manage, and collaborate on Docker images
Pluggable storage drivers
Configuration options to let you run DTR in your particular enterprise environment.
Easy, transparent upgrades
Logging, usage and system health metrics
But doesn't the "normal" Docker Registry give me these as well?!?
Are these two things really the same, or is DTR some sort of commercialized offering of a Docker Registry? Or something else? I'm so confused!
New features in Docker Trusted Registry are:
Control access and permissions by user or organisation
Web UI to search and browse repos, manage users and setting
Integrate to CI and CD systems to automate workflows
LDAP/AD integration
Flexible storage
support User audit logs
Soft Delete image tags
Garbage collection
DTR is the paid support service for the registry - see https://hub.docker.com/enterprise/
Basically, they help you setup and will give you support down the road. It might have some niceties, otherwise you are left to your own to figure out how to run the registry.
Related
We are building a proprietary Java application based on Docker. Right now, we are using local docker installation and development is in progress. When we want to share this application, hope this should be deployed in some docker registry. Docker registry is free and opensource? or how can I securely+freely allow my customers to access my application?.Basically, we want zero cost secure deployment option using docker.
If you're fine with putting your docker images public - you can use the docker hub.
If you want to keep it private - you can opt for one of the free private registries, e.g. treescale
See a longer list of free private registries here
I need to block all registries and allow only one private registry for docker to pull images from , how can that be done natively in docker.
Using the RedHat options will not work on the upstream Docker CE or EE engine, RedHat had forked the docker engine and added their own features that are incompatible. You'll also find that /etc/sysconfig/docker is a RedHat only configuration file, designed to work with their version of the startup scripts. And I don't believe RedHat supports this old fork either, instead preferring their own podman and crio runtimes.
A hard limit on registry servers is not currently supported in the Linux Docker engine. The standard way to implement this for servers is with firewall rules on outbound connections, but that needs to only permit outbound connections to a known allow list. You still need to ensure that users don't import images from a tar file, or rebuild the otherwise blocked images from scratch (for example, all of official images on Docker Hub have the source available to rebuild them).
With Docker Desktop, the ability to restrict what registries a user can pull from has been added in their paid business tier with their image access management.
Previously I might have suggested using Notary and Docker Content Trust to ensure you only run trusted images, but that tooling has a variety of known issue, including the use of TOFU (trust on first use) that allows any image from a repo that hasn't been seen before to be signed by anyone and trusted to run. There are a few attempts to replace this, and the current leader is sigstore/cosign, but that isn't integrated directly into the docker engine. If you run in Kubernetes, this would be configured in your admission controller, like Gatekeeper or Kyverno.
Just found in redhat docs:
This can be done on docker daemon config:
/etc/sysconfig/docker
BLOCK_REGISTRY='--block-registry=all'
ADD_REGISTRY='--add-registry=registry.access.redhat.com'
and then do:
systemctl restart docker
Maybe a simple-to-answer Question: How can I set up a private docker reposiory and limit the Access to only a subset of the Images there that one can pull ? E.g. I have Image1 and Image2 pushed, but want to allow one Image2 being pullable by account USER1 ?
This tends to get into the commercial offerings of docker (DTR). The spec itself for the registry includes all of the capabilities for auth, and you can configure a simple htpasswd based login on the standalone registry. However for the next step up, you get into a token server which docker doesn't have an open source implementation of themselves. You could work around this limitation by deploying multiple registry servers, each with a different set of users in a htpasswd file.
There are various third party implementations of the docker registry that may include these features. In the open source space, there's a project called cesanta/docker_auth that works with docker's stand alone registry and does exactly what you're looking for. The next step up is the harbor project that should be all most organizations need from a registry, but may be more complicated and have more overhead for a small project.
I'm about to configure my DTR "Docker Trusted Registry" for the first time and it seems complicated.
So before making an entire decision, I want to know what is the difference between "Docker Hub" and "Docker Trusted Registry"?
Thank you
Docker Hub is a SaaS based solution hosted in the cloud where you have public and optionally paid private repositories.
DTR is part of the on-premises enterprise edition (EE) solution. It consist of:
a supported docker engine that updates less frequently than the community edition and includes 1 year of support for any given release.
using swarm mode for scheduling services
support for Kubernetes has just been added in the 2.0 release
UCP (universal control plane) for RBAC security
DTR (docker trusted registry) for an enterprise registry
Over the self hosted free registry, DTR adds RBAC security that piggy backs on UCP, image scanning of all the layers of the image against well known vulnerability databases, replication for HA, built in garbage collection of deleted images, image promotion policies, and multiple storage backends to keep your image data in an HA location. The first two (RBAC and vulnerability scanning) are the main features enterprises are looking for when selecting DTR in addition to the commercial support provided by Docker Inc.
I've been considering to use my own private docker registry to distribute some of my projects publicly. However, the moment you add an authentication strategy to your registry, you loose public pull access to all its images.
Is there an easy way to tell the registry some images can be anonymously pulled (not pushed, of course) - in the same way https://hub.docker.com/ works?
I've been reading through https://docs.docker.com/registry docs but so far I found nothing on the matter. I guess it's a use case covered in EE Docker Trusted Registry and not included in the community version:
DTR uses Role Based Access Control (RBAC) to allow you to implement fine-grained access control policies for who has access to your Docker images.
You can check 3rdparty Registry projects that allow fine grain access like Portus or Harbor, I use harbor and the projects set as public can be pulled anonymously