Docker private registry with mirror

Question

I created two Docker containers. The first one provides a private Docker registry and the second one is a mirror of the official Docker registry:

docker run -d --name registry -v /local/path/to/registry:/registry -e SETTINGS_FLAVOR=local -e STORAGE_PATH=/registry -p 5000:5000 registry

docker run -d --name mirror -v /local/path/to/mirror:/registry -e STORAGE_PATH=/registry -e STANDALONE=false -e MIRROR_SOURCE=https:/registry-1.docker.io -e MIRROR_SOURCE_INDEX=https://index.docker.io -p 5555:5000 registry

Now I would like to combine both. Whenever a user pulls images it should first query the private registry and then the mirror. And when images are pushed they should only be pushed to the private registry.

I do not have an idea about how this can be done. Any help is appreciated.

Answer 1

Repository names are intended to be global, that is the repository redis always refers to the official Redis image from the Docker Hub. If you want to use a private registry, you prefix the repository name with the name of the registry e.g. localhost.localdomain:5000/myimage:mytag.

So when you pull or push, it will automatically go to the relevant registry. The mirror should be easy to set up, you just pass the URL to the daemon with the --registry-mirror= argument.

This isn't perfect for enterprise users, hence this (closed) Docker issue.

Answer 2

Just to be clear, docker documentation confirms that:

It’s currently not possible to mirror another private registry. Only the central Hub can be mirrored.

Answer 3

You cannot just force all docker push commands to push to your private registry. One reason is that you can have any number of those registers. You have to first tell docker where to push by tagging the image (see lower).

Here is how you can setup docker hosts to work with a running private registry and local mirror.

Client set-up

Lets assume that you are running both mirror and private registry on (resolvable) host called dockerstore. Mirror on port 5555, registry on 5000.

Then on client machine(s) you should pass extra options to docker daemon startup. In your case:

1. Add --registry-mirror=http://dockerstore:5555 to tell daemon to prefer using local mirror rather then dockerhub. source
2. Add --insecure-registry dockerstore:5000 to access the private registry without further configuration. See this answer
3. Restart docker daemon

Using the mirror

When you pull any image the first source will be the local mirror. You can confirm by running a docker pull, e.g.

docker pull debian

In the output there will be message that image is being pulled from your mirror - dockerstore:5000

Using local registry

In order to push to private registry first you have to tag the image to be pushed with full name of the registry. Make sure that you have a dot or colon in the first part of the tag, to tell docker that image should be pushed to private registry.

Docker looks for either a “.” (domain separator) or “:” (port separator) to learn that the first part of the repository name is a location and not a user name.

Example:

Tag 30d39e59ffe2 image as dockerstore:5000/myapp:stable

docker tag 30d39e59ffe2 dockerstore:5000/myapp:stable

Push it to private registry

docker push dockerstore:5000/myapp:stable

Then you can pull as well

docker pull dockerstore:5000/myapp:stable