Skip to content

Commit d550d72

Browse files
author
Mary Anthony
committed
Initial work
Removing references to regsitry 1.0, pointing to distribution Updating links and title Adding in comments Signed-off-by: Mary Anthony <[email protected]>
1 parent 4bfbeb8 commit d550d72

7 files changed

Lines changed: 72 additions & 1453 deletions

File tree

‎docs/articles/certificates.md‎

Lines changed: 4 additions & 108 deletions
Original file line numberDiff line numberDiff line change
@@ -11,111 +11,7 @@ weight = 7
1111

1212
# Using certificates for repository client verification
1313

14-
In [Running Docker with HTTPS](/articles/https), you learned that, by default,
15-
Docker runs via a non-networked Unix socket and TLS must be enabled in order
16-
to have the Docker client and the daemon communicate securely over HTTPS.
17-
18-
Now, you will see how to allow the Docker registry (i.e., *a server*) to
19-
verify that the Docker daemon (i.e., *a client*) has the right to access the
20-
images being hosted with *certificate-based client-server authentication*.
21-
22-
We will show you how to install a Certificate Authority (CA) root certificate
23-
for the registry and how to set the client TLS certificate for verification.
24-
25-
## Understanding the configuration
26-
27-
A custom certificate is configured by creating a directory under
28-
`/etc/docker/certs.d` using the same name as the registry's hostname (e.g.,
29-
`localhost`). All `*.crt` files are added to this directory as CA roots.
30-
31-
> **Note:**
32-
> In the absence of any root certificate authorities, Docker
33-
> will use the system default (i.e., host's root CA set).
34-
35-
The presence of one or more `<filename>.key/cert` pairs indicates to Docker
36-
that there are custom certificates required for access to the desired
37-
repository.
38-
39-
> **Note:**
40-
> If there are multiple certificates, each will be tried in alphabetical
41-
> order. If there is an authentication error (e.g., 403, 404, 5xx, etc.), Docker
42-
> will continue to try with the next certificate.
43-
44-
Our example is set up like this:
45-
46-
/etc/docker/certs.d/ <-- Certificate directory
47-
└── localhost <-- Hostname
48-
├── client.cert <-- Client certificate
49-
├── client.key <-- Client key
50-
└── localhost.crt <-- Registry certificate
51-
52-
## Creating the client certificates
53-
54-
You will use OpenSSL's `genrsa` and `req` commands to first generate an RSA
55-
key and then use the key to create the certificate.
56-
57-
$ openssl genrsa -out client.key 4096
58-
$ openssl req -new -x509 -text -key client.key -out client.cert
59-
60-
> **Warning:**:
61-
> Using TLS and managing a CA is an advanced topic.
62-
> You should be familiar with OpenSSL, x509, and TLS before
63-
> attempting to use them in production.
64-
65-
> **Warning:**
66-
> These TLS commands will only generate a working set of certificates on Linux.
67-
> The version of OpenSSL in Mac OS X is incompatible with the type of
68-
> certificate Docker requires.
69-
70-
## Testing the verification setup
71-
72-
You can test this setup by using Apache to host a Docker registry.
73-
For this purpose, you can copy a registry tree (containing images) inside
74-
the Apache root.
75-
76-
> **Note:**
77-
> You can find such an example [here](
78-
> http://people.gnome.org/~alexl/v1.tar.gz) - which contains the busybox image.
79-
80-
Once you set up the registry, you can use the following Apache configuration
81-
to implement certificate-based protection.
82-
83-
# This must be in the root context, otherwise it causes a re-negotiation
84-
# which is not supported by the TLS implementation in go
85-
SSLVerifyClient optional_no_ca
86-
87-
<Location /v1>
88-
Action cert-protected /cgi-bin/cert.cgi
89-
SetHandler cert-protected
90-
91-
Header set x-docker-registry-version "0.6.2"
92-
SetEnvIf Host (.*) custom_host=$1
93-
Header set X-Docker-Endpoints "%{custom_host}e"
94-
</Location>
95-
96-
Save the above content as `/etc/httpd/conf.d/registry.conf`, and
97-
continue with creating a `cert.cgi` file under `/var/www/cgi-bin/`.
98-
99-
#!/bin/bash
100-
if [ "$HTTPS" != "on" ]; then
101-
echo "Status: 403 Not using SSL"
102-
echo "x-docker-registry-version: 0.6.2"
103-
echo
104-
exit 0
105-
fi
106-
if [ "$SSL_CLIENT_VERIFY" == "NONE" ]; then
107-
echo "Status: 403 Client certificate invalid"
108-
echo "x-docker-registry-version: 0.6.2"
109-
echo
110-
exit 0
111-
fi
112-
echo "Content-length: $(stat --printf='%s' $PATH_TRANSLATED)"
113-
echo "x-docker-registry-version: 0.6.2"
114-
echo "X-Docker-Endpoints: $SERVER_NAME"
115-
echo "X-Docker-Size: 0"
116-
echo
117-
118-
cat $PATH_TRANSLATED
119-
120-
This CGI script will ensure that all requests to `/v1` *without* a valid
121-
certificate will be returned with a `403` (i.e., HTTP forbidden) error.
14+
The orginal content was deprecated. For information about configuring
15+
cerficates, see [deploying a registry
16+
server](http://docs.docker.com/registry/deploying/). To reach an older version
17+
of this content, refer to an older version of the documentation.

‎docs/articles/registry_mirror.md‎

Lines changed: 5 additions & 78 deletions
Original file line numberDiff line numberDiff line change
@@ -11,81 +11,8 @@ weight = 8
1111

1212
# Run a local registry mirror
1313

14-
## Why?
15-
16-
If you have multiple instances of Docker running in your environment
17-
(e.g., multiple physical or virtual machines, all running the Docker
18-
daemon), each time one of them requires an image that it doesn't have
19-
it will go out to the internet and fetch it from the public Docker
20-
registry. By running a local registry mirror, you can keep most of the
21-
image fetch traffic on your local network.
22-
23-
## How does it work?
24-
25-
The first time you request an image from your local registry mirror,
26-
it pulls the image from the public Docker registry and stores it locally
27-
before handing it back to you. On subsequent requests, the local registry
28-
mirror is able to serve the image from its own storage.
29-
30-
## How do I set up a local registry mirror?
31-
32-
There are two steps to set up and use a local registry mirror.
33-
34-
### Step 1: Configure your Docker daemons to use the local registry mirror
35-
36-
You will need to pass the `--registry-mirror` option to your Docker daemon on
37-
startup:
38-
39-
docker daemon --registry-mirror=http://<my-docker-mirror-host>
40-
41-
For example, if your mirror is serving on `http://10.0.0.2:5000`, you would run:
42-
43-
docker daemon --registry-mirror=http://10.0.0.2:5000
44-
45-
**NOTE:**
46-
Depending on your local host setup, you may be able to add the
47-
`--registry-mirror` options to the `DOCKER_OPTS` variable in
48-
`/etc/default/docker`.
49-
50-
### Step 2: Run the local registry mirror
51-
52-
You will need to start a local registry mirror service. The
53-
[`registry` image](https://registry.hub.docker.com/_/registry/) provides this
54-
functionality. For example, to run a local registry mirror that serves on
55-
port `5000` and mirrors the content at `registry-1.docker.io`:
56-
57-
docker run -p 5000:5000 \
58-
-e STANDALONE=false \
59-
-e MIRROR_SOURCE=https://registry-1.docker.io \
60-
-e MIRROR_SOURCE_INDEX=https://index.docker.io \
61-
registry
62-
63-
## Test it out
64-
65-
With your mirror running, pull an image that you haven't pulled before (using
66-
`time` to time it):
67-
68-
$ time docker pull node:latest
69-
Pulling repository node
70-
[...]
71-
72-
real 1m14.078s
73-
user 0m0.176s
74-
sys 0m0.120s
75-
76-
Now, remove the image from your local machine:
77-
78-
$ docker rmi node:latest
79-
80-
Finally, re-pull the image:
81-
82-
$ time docker pull node:latest
83-
Pulling repository node
84-
[...]
85-
86-
real 0m51.376s
87-
user 0m0.120s
88-
sys 0m0.116s
89-
90-
The second time around, the local registry mirror served the image from storage,
91-
avoiding a trip out to the internet to refetch it.
14+
The orginal content was deprecated. [An archived
15+
version](https://docs.docker.com/v1.6/articles/registry_mirror) is available in
16+
the 1.7 documentation. For information about configuring mirrors with the latest
17+
Docker Registry version, please file a support request with [the Distribution
18+
project](https://github.com/docker/distribution/issues).

‎docs/introduction/understanding-docker.md‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -116,11 +116,11 @@ images, or you can download Docker images that other people have already created
116116
Docker images are the **build** component of Docker.
117117

118118
#### Docker registries
119-
Docker registries hold images. These are public or private stores from which you upload
120-
or download images. The public Docker registry is called
121-
[Docker Hub](http://hub.docker.com). It provides a huge collection of existing
122-
images for your use. These can be images you create yourself or you
123-
can use images that others have previously created. Docker registries are the
119+
Docker registries hold images. These are public or private stores from which you
120+
upload or download images. The public Docker registry is provided with the
121+
[Docker Hub](http://hub.docker.com). It serves a huge collection of existing
122+
images for your use. These can be images you create yourself or you can use
123+
images that others have previously created. Docker registries are the
124124
**distribution** component of Docker.
125125

126126
#### Docker containers
@@ -179,8 +179,9 @@ returns a final image.
179179

180180
### How does a Docker registry work?
181181
The Docker registry is the store for your Docker images. Once you build a Docker
182-
image you can *push* it to a public registry [Docker Hub](https://hub.docker.com) or to
183-
your own registry running behind your firewall.
182+
image you can *push* it to a public registry such as the one provided by [Docker
183+
Hub](https://hub.docker.com) or to your own registry running behind your
184+
firewall.
184185

185186
Using the Docker client, you can search for already published images and then
186187
pull them down to your Docker host to build containers from them.

‎docs/misc/faq.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -97,7 +97,7 @@ with several powerful functionalities:
9797
applications. Your ideal PostgreSQL setup can be re-used for all your future
9898
projects. And so on.
9999

100-
- *Sharing.* Docker has access to a [public registry](https://registry.hub.docker.com/)
100+
- *Sharing.* Docker has access to a public registry [on Docker Hub](https://registry.hub.docker.com/)
101101
where thousands of people have uploaded useful containers: anything from Redis,
102102
CouchDB, PostgreSQL to IRC bouncers to Rails app servers to Hadoop to base
103103
images for various Linux distros. The

0 commit comments

Comments
 (0)