3 ms·

Setting up a private repository is a PITA? It's one command: docker run -p 5000:5000 registry Want to back it with S3 or another storage provider? It's stil

by lgbr 12y ago

Setting up a private repository is a PITA? It's one command: docker run -p 5000:5000 registry Want to back it with S3 or another storage provider? It's still one command: docker run -e SETTINGS_FLAVOR=s3 -e AWS_BUCKET=acme-docker -e STORAGE_PATH=/registry -e AWS_KEY=AKIAHSHB43HS3J92MXZ -e AWS_SECRET=xdDowwlK7TJajV1Y7EoOZrmuPEJlHYcNP2k4j49T -e SEARCH_BACKEND=sqlalchemy -p 5000:5000 registry What's so pain in the ass about this?

rabino 12y ago
did you just post your s3 secret key?
- tethra 12y ago
  I was wondering, too..
- shitlord 12y ago
  According to google, this isn't the first time that key was posted. It's here[1] too. [1]: https://pypi.python.org/pypi/docker-registry/0.7.3 https://pypi.python.org/pypi/docker-registry/0.7.3
- kachnuv_ocasek 12y ago
  No, it's an example from the readme: https://github.com/docker/docker-registry#quick-start https://github.com/docker/docker-registry#quick-start
  - kordless 12y ago
    It's faster to type the question than it was to look it up, like you did. Thanks for spending the time doing so!
- Matheo05 12y ago
  In fact, it comes from the Docker GitHub page https://github.com/docker/docker-registry/tree/master https://github.com/docker/docker-registry/tree/master
- projectramo 12y ago
  We should not be too harsh with people who inadvertently post their secret key. They may be very nice, well-meaning, smart people who, you know, make a mistake and post their key. Maybe it is in an environment file, and they post it to their public github. Could happen. Maybe they forgot and went to sleep, and found out their key got jacked. Maybe -- hypothetical here -- someone ran up $1000s of dollars producing bitcoins on this innocent person's account who made one mistake. One tiny mistake. You never know.
  - rabino 12y ago
    Not sure you are talking to me, but my comment wasn't harsh at all. Just trying to make sure he noticed and fixed it in case it was his real key.
    - projectramo 12y ago
      No, I was talking about a "friend" of mine who got himself in trouble.
antocv 12y ago
Yes I have ran that command, I have docker registry running, then I wanted to clean that port and so I put nginx infront and let it proxypass... and have a onename alias for the host that serves the registry so its used by all the machines. But then you see the hostname is confused for username by docker. Argh crap so it cant be clean, at least has to have fqdn. Or port number. Its stuff like this man. Documentation should say it "we dont want you to use other registry than ours docker.io its possible but nah". Another issue is, how would you set to use private repo by default? Hm? And never hit docker.io?
- ninkendo 12y ago
  +1. The private registry story is horrible in docker. You have to tag your image with your registry's FQDN, which is an absolutely braindead idea. It's nice to default to docker.io in the absence of options, but I should really be able to do "docker pull --registry myregistry.local ubuntu:latest" and have it work. Instead I have to do "docker pull myregistry.local/ubuntu", which pulls the image and tags it as "myregistry.local/ubuntu". Great, now my registry FQDN is in my image tag. For any decent automation now you have to re-tag it without the "myregistry.local" so you don't depend on your registry FQDN everywhere. But then you better remember to re-tag it with your registry before you push! In our case we wrote an HDFS driver for the registry so we could store images everywhere, and a service discovery layer to discover registry endpoints (using a load balancer just plain didn't work.) It's an unholy nightmare (but at least we've automated it) to continually re-tag images to go to the endpoint you want.

by lgbr 12y ago

rabino 12y ago

did you just post your s3 secret key?

tethra 12y ago
I was wondering, too..
shitlord 12y ago
According to google, this isn't the first time that key was posted. It's here[1] too. [1]: https://pypi.python.org/pypi/docker-registry/0.7.3 https://pypi.python.org/pypi/docker-registry/0.7.3
kachnuv_ocasek 12y ago
No, it's an example from the readme: https://github.com/docker/docker-registry#quick-start https://github.com/docker/docker-registry#quick-start
- kordless 12y ago
  It's faster to type the question than it was to look it up, like you did. Thanks for spending the time doing so!
Matheo05 12y ago
In fact, it comes from the Docker GitHub page https://github.com/docker/docker-registry/tree/master https://github.com/docker/docker-registry/tree/master
projectramo 12y ago
We should not be too harsh with people who inadvertently post their secret key. They may be very nice, well-meaning, smart people who, you know, make a mistake and post their key. Maybe it is in an environment file, and they post it to their public github. Could happen. Maybe they forgot and went to sleep, and found out their key got jacked. Maybe -- hypothetical here -- someone ran up $1000s of dollars producing bitcoins on this innocent person's account who made one mistake. One tiny mistake. You never know.
- rabino 12y ago
  Not sure you are talking to me, but my comment wasn't harsh at all. Just trying to make sure he noticed and fixed it in case it was his real key.
  - projectramo 12y ago
    No, I was talking about a "friend" of mine who got himself in trouble.

antocv 12y ago

Yes I have ran that command, I have docker registry running, then I wanted to clean that port and so I put nginx infront and let it proxypass... and have a onename alias for the host that serves the registry so its used by all the machines. But then you see the hostname is confused for username by docker. Argh crap so it cant be clean, at least has to have fqdn. Or port number. Its stuff like this man. Documentation should say it "we dont want you to use other registry than ours docker.io its possible but nah". Another issue is, how would you set to use private repo by default? Hm? And never hit docker.io?

ninkendo 12y ago
+1. The private registry story is horrible in docker. You have to tag your image with your registry's FQDN, which is an absolutely braindead idea. It's nice to default to docker.io in the absence of options, but I should really be able to do "docker pull --registry myregistry.local ubuntu:latest" and have it work. Instead I have to do "docker pull myregistry.local/ubuntu", which pulls the image and tags it as "myregistry.local/ubuntu". Great, now my registry FQDN is in my image tag. For any decent automation now you have to re-tag it without the "myregistry.local" so you don't depend on your registry FQDN everywhere. But then you better remember to re-tag it with your registry before you push! In our case we wrote an HDFS driver for the registry so we could store images everywhere, and a service discovery layer to discover registry endpoints (using a load balancer just plain didn't work.) It's an unholy nightmare (but at least we've automated it) to continually re-tag images to go to the endpoint you want.