How to get remote access to a private docker-regis

Question

I'm trying to setup a private docker registry using the image taken from: https://github.com/docker/docker-registry

Just by running:
docker run -p 5000:5000 registry

I can pull/push from/to this repository only from localhost, but if i try to access it from another machine (using a private address on the same LAN) it fails with an error message:

*2014/11/03 09:49:04 Error: Invalid registry endpoint https ://10.0.0.26:5000/v1/': 
Get https:// 10.0.0.26:5000/v1/_ping: Forbidden. If this private 
registry supports only HTTP or HTTPS with an unknown CA certificate,
please add `--insecure-registry 10.0.0.26:5000` to the daemon's 
arguments. In the case of HTTPS, if you have access to the registry's
CA certificate, no need for the flag; simply place the CA certificate 
at /etc/docker/certs.d/10.0.0.26:5000/ca.crt*

What drives me crazy is that I can access it successfully using: curl 10.0.0.26:5000 and/or curl 10.0.0.26:5000/v1/search

I also don't understand where and how I should pass the --insecure-registry flag.

Answer 1

This is based on the answer from vikas027 on Centos 7 and Docker 1.12

Since I am behind a proxy my full solution was ...

/etc/systemd/system/docker.service.d/http-proxy.conf

[Service]

Environment="FTP_PROXY={{MY_PROXY}}"
Environment="ftp_proxy={{MY_PROXY}}"

Environment="HTTPS_PROXY={{MY_PROXY}}"
Environment="https_proxy={{MY_PROXY}}"

Environment="HTTP_PROXY={{MY_PROXY}}"
Environment="http_proxy={{MY_PROXY}}"

Environment="NO_PROXY=localhost,127.0.0.1,{{MY_INSECURE_REGISTRY_IP}}"
Environment="no_proxy=localhost,127.0.0.1,{{MY_INSECURE_REGISTRY_IP}}"

/usr/lib/systemd/system/docker.service

ExecStart=/usr/bin/dockerd --insecure-registry {{MY_INSECURE_REGISTRY_IP}}:5000

and dont forget to restart :)

sudo systemctl daemon-reload; sudo systemctl restart docker;

Answer 2

Docker 1.12.1

For CentOS 7.2

/usr/lib/systemd/system/docker.service
#ExecStart=/usr/bin/dockerd
ExecStart=/usr/bin/dockerd --insecure-registry my-docker-registry.com:5000

For ubuntu 16.04

/lib/systemd/system/docker.service
#ExecStart=/usr/bin/dockerd -H fd://
ExecStart=/usr/bin/dockerd --insecure-registry my-docker-registry.com:5000 -H fd://

sudo systemctl stop docker
sudo systemctl daemon-reload
sudo systemctl start docker

It seems the --insecure-registry option may be used both with and without the "=" between it and the registry ID.

Answer 3

Ubuntu 16.04

Create (does not exist) file /etc/systemd/system/docker.service.d/registry.conf with contents:

[Service]
#You need the below or you 'ExecStart=' or you will get and error 'Service has more than one ExecStart= setting, which is only allowed'
ExecStart=
ExecStart=/usr/bin/dockerd -H fd:// --insecure-registry 10.20.30.40:5000

then

sudo systemctl stop docker
sudo systemctl daemon-reload
sudo systemctl start docker

Answer 4

I found the following to be very useful as it discusses how the Docker service itself is configured. https://docs.docker.com/articles/systemd/

Along with this article on the systemctl command https://www.digitalocean.com/community/tutorials/how-to-use-systemctl-to-manage-systemd-services-and-units

I used the following series of commands in a Centos 7 based container with a registry image obtained by "docker pull registry:2.1.1"

sudo mkdir -p /etc/systemd/system/docker.service.d
cd /etc/systemd/system/docker.service.d
sudo touch override.conf
sudo nano override.conf

And inside the override.conf added the following.

[Service]
ExecStart=
ExecStart=/usr/bin/docker -d -H tcp://0.0.0.0:2375 -H unix:///var/run/docker.sock --insecure-registry 10.2.3.4:5000

Note the first, blank, ExecStart= clears anything that is already in place so be sure to add anything from the /usr/lib/systemd/system/docker.service ExecStart= statement that you wish to retain.

If you don't specify the -d(daemon) option you'll get a "Please specify only one -H" error.

After issuing the following series of commands I can see my overrides in place.

sudo systemctl stop docker
sudo systemctl daemon-reload
sudo systemctl start docker
sudo systemctl status docker

docker.service - Docker Application Container Engine
   Loaded: loaded (/usr/lib/systemd/system/docker.service; enabled)
  Drop-In: /etc/systemd/system/docker.service.d
           └─override.conf
   Active: active (running) since Thu 2015-09-17 13:37:34 AEST; 7s ago
     Docs: https://docs.docker.com
 Main PID: 5697 (docker)
   CGroup: /system.slice/docker.service
           └─5697 /usr/bin/docker -d -H tcp://0.0.0.0:2375 -H unix:///var/run/docker.sock --insecure-registry 10.2.3.4:5000

NOTE: The information provided by Loaded: and Drop-In: lines in the status message, the are useful for checking what's happening with a pre-existing docker daemon to work.

NOTE: Also have a look in the Loaded: docker.service file for an EnvironmentFile= for further clues.

Answer 5

I found that docker client version and registry docker version has to match up, else you would run into connectivity issues, despite having everything in place.

Answer 6

The following has been tested with:

ubuntu@ubuntu-xenial:~$ docker -v
Docker version 17.05.0-ce, build 89658be

---

I tried all of above mentioned answers, but none of these worked for me.

I was following these instructions in order to make it work

openssl req \
  -newkey rsa:4096 -nodes -sha256 -keyout certs/domain.key \
  -x509 -days 365 -out certs/domain.crt

and

Linux: Copy the domain.crt file to
/etc/docker/certs.d/myregistrydomain.com:5000/ca.crt on every Docker
host. You do not need to restart Docker.

and other issues occurred that were solved as follows:

Issue 1

Error response from daemon: Get https://10.20.30.40:8001/v1/users/: x509: cannot validate certificate for 10.20.30.40 because it doesn't contain any IP SANs

solution

host mapping in /etc/hosts:

10.20.30.40 somehost

Issue 2

Error response from daemon: Get https://somehost:8001/v1/users/: x509: certificate is valid for , not somehost

solution

rerun the openssl command

$ openssl req \
  -newkey rsa:4096 -nodes -sha256 -keyout certs/domain.key \
  -x509 -days 365 -out certs/domain.crt

press enter at every step except at:

Common Name (e.g. server FQDN or YOUR name) []:

and type the fqdn of the registry, i.e. somehost

Be sure to use the name myregistrydomain.com as a CN.

logging in to the registry succeeds now

Issue 3

Error response from daemon: Get https://somehost:8001/v1/users/: x509: certificate signed by unknown authority

solution

sudo mkdir -p /etc/docker/certs.d/somehost:8001/
sudo cp certs/domain.crt /etc/docker/certs.d/somehost:8001/ca.crt