Docker private registry with mirror

Question

I created two Docker containers. The first one provides a private Docker registry and the second one is a mirror of the official Docker registry:

docker run -d --name registry -v /local/path/to/registry:/registry -e SETTINGS_FLAVOR=local -e STORAGE_PATH=/registry -p 5000:5000 registry

docker run -d --name mirror -v /local/path/to/mirror:/registry -e STORAGE_PATH=/registry -e STANDALONE=false -e MIRROR_SOURCE=https:/registry-1.docker.io -e MIRROR_SOURCE_INDEX=https://index.docker.io -p 5555:5000 registry

Now I would like to combine both. Whenever a user pulls images it should first query the private registry and then the mirror. And when images are pushed they should only be pushed to the private registry.

I do not have an idea about how this can be done. Any help is appreciated.

Hypercriticism

Answer 1

You cannot just force all docker push commands to push to your private registry. One reason is that you can have any number of those registers. You have to first tell docker where to push by tagging the image (see lower).

Here is how you can setup docker hosts to work with a running private registry and local mirror.

Client set-up

Lets assume that you are running both mirror and private registry on (resolvable) host called dockerstore. Mirror on port 5555, registry on 5000.

Then on client machine(s) you should pass extra options to docker daemon startup. In your case:

1. Add --registry-mirror=http://dockerstore:5555 to tell daemon to prefer using local mirror rather then dockerhub. source
2. Add --insecure-registry dockerstore:5000 to access the private registry without further configuration. See this answer
3. Restart docker daemon

Using the mirror

When you pull any image the first source will be the local mirror. You can confirm by running a docker pull, e.g.

docker pull debian

In the output there will be message that image is being pulled from your mirror - dockerstore:5000

Using local registry

In order to push to private registry first you have to tag the image to be pushed with full name of the registry. Make sure that you have a dot or colon in the first part of the tag, to tell docker that image should be pushed to private registry.

Docker looks for either a “.” (domain separator) or “:” (port separator) to learn that the first part of the repository name is a location and not a user name.

Example:

Tag 30d39e59ffe2 image as dockerstore:5000/myapp:stable

docker tag 30d39e59ffe2 dockerstore:5000/myapp:stable

Push it to private registry

docker push dockerstore:5000/myapp:stable

Then you can pull as well

docker pull dockerstore:5000/myapp:stable

Refreshing

404 on your --registry-mirror link. See github.com/docker/distribution/issues/1336 for my request to restore / replace said missing content. – Calcicole

Answer 2

If not present, create the file:

sudo nano /etc/docker/daemon.json

Then paste the following:

{
  "registry-mirrors": [
    "https://hub-mirror.c.163.com",
    "https://mirror.baidubce.com"
  ]
}

Then retart Docker daemon

$ sudo systemctl restart docker

[Source]

Relativistic

how to achieve this on windows, particularly when using docker desktop. – Fulmis

Answer 3

Just to be clear, docker documentation confirms that:

It’s currently not possible to mirror another private registry. Only the central Hub can be mirrored.

Syllabic

The question was about how to mirror the official registry, not a private one. In addition a private registry should be used but be mirrored. – Hypercriticism

Best solution, then, might be to use Red Hat's fork (v1.10) of Docker. You can use both the "--add-registry" and "--registry-mirror" flags. I found that this has the added benefit of being able to pull an image through the mirror (from the official library), push it back into the private registry, and pull from the private registry, all without any re-tagging of the image. – Syllabic

It seems awesome. Where is the "Red Hat's fork (v1.10) of Docker" located? Any github repo or sth? – Arnuad

Update: use podman. – Syllabic

Answer 4

Repository names are intended to be global, that is the repository redis always refers to the official Redis image from the Docker Hub. If you want to use a private registry, you prefix the repository name with the name of the registry e.g. localhost.localdomain:5000/myimage:mytag.

So when you pull or push, it will automatically go to the relevant registry. The mirror should be easy to set up, you just pass the URL to the daemon with the --registry-mirror= argument.

This isn't perfect for enterprise users, hence this (closed) Docker issue.

Promote

Excuse me,I use the method to create mirror, but it didn't work. Can you help me? #31517888 – Smokejumper