How to deploy a Docker image from a private repository on Cloud Foundry?

Question

I pushed a local Docker image with

docker push bspartifact.artifactory.example.com/bspartifact:1.0

to my private Docker hub. How can I now deploy that image to Cloud Foundry? The repo is secured by a basic authentication with username and password. Thanks.

Edit:

Trying the --docker-username flag results in the following error:

Staging...
Staging process started ...
Failed to talk to docker registry: Get https://bspartifact.artifactory.example.com/v2/: dial tcp 10.xx.xxx.xxx:443: getsockopt: connection refused
Failed to talk to docker registry: Get http://bspartifact.artifactory.example.com/v2/: dial tcp 10.xx.xxx.xxx:80: getsockopt: connection refused

Lois

Did you docker login to your registry mate? – Sprawl

Yes I did. I also tried --docker-username as mentioned in the answer below. – Lois

Show us docker -v – Sprawl

Docker version 17.03.1-ce, build c6d412e – Lois

Answer 1

As mentioned from dkoper - you have to use cf CLI 6.28.0 or higher. But your Cloud Foundry provider should also support this. The feature to push docker images was implemented with Cloud Foundry api version 2.82.0. You can check on which api version your Cloud Foundry provider is running with cf api.

Darius

Answer 2

Using cf CLI 6.28.0 or higher, run cf push myapp -o bspartifact.artifactory.example.com/bspartifact:1.0 --docker-username myuser. This will prompt you for your password.
For non-interactive use, set environment property CF_DOCKER_PASSWORD to your password and the CLI will use that.
Refer to the following documentation for details: http://docs.cloudfoundry.org/devguide/deploy-apps/push-docker.html#private-repo

Ramage

Thanks. Unfortunately this throws an error. I copied the error message into my question. – Lois

Note that all the CLI does is tell your targeted CF to download the Docker image from the registry you specified when starting the app. So your registry must be accessible from the Diego cell. The error seems to indicate it cannot. Is your registry on a network routable from CF? Have you configured your application security groups to allow this access? – Ramage

Thank you. The weird thing is that if I do the same with my local Docker it works. However if I try to execute this command for CF I get an error. CF and my hub even run in the same environment. – Lois

Use cf space your-space --security-group-rules to view whether there are any security groups (it's a whitelist of IP ranges/ports) allowing CF access to your Docker registry. 10.x is not in there by default (public_networks excludes 10.x range). As mentioned, private Docker repo support was added in CF v260 (CC API 2.82.0). If you're on an older, I would expect to see an authentication error (CLI passes credentials to CC but CC ignores them, so authentication with Docker registry fails). – Ramage