도커 레지스트리 만들기

$ sudo ls /var/lib/docker/containers
1a174fc216cccf18ec7d4fe14e008e30130b11ede0f0f94a87982e310cf2e765
1e7264576d78a3134fbaf7829bc24b1d96017cf2bc046b7cd8b08b5775c33d0c
38fa94212a419a082e6a6b87a8e2ec4a44dd327d7069b85892a707e3fc818544
c36785c423ec7e0422b2af7364a7ba4da6146cbba7981a0951fcc3fa0430c409
dcad7101795e4206e637d9358a818e5c32e13b349e62b00bf05cd5a4343ea513

docker save my_image > my_image.tar

$ wget https://dl.eff.org/certbot-auto
--2019-08-21 17:22:02--  https://dl.eff.org/certbot-auto
Resolving dl.eff.org (dl.eff.org)... 151.101.0.201, 151.101.64.201, 151.101.128.201, ...
Connecting to dl.eff.org (dl.eff.org)|151.101.0.201|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 68689 (67K) [application/octet-stream]
Saving to: 'certbot-auto'  
certbot-auto      100%[==================================>]  67.08K   259KB/s    in 0.3s  
2019-08-21 17:22:03 (259 KB/s) - 'certbot-auto' saved [68689/68689]

chmod +x certbot-auto
sudo mv certbot-auto /usr/local/bin/certbot-auto

$ certbot-auto certonly --standalone -d registry.example.com \
--preferred-challenges http \
--agree-tos -n -m email@example.com \
--keep-until-expiring  
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator standalone, Installer None
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for registry.example.com
Waiting for verification...
Cleaning up challenges  
IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/registry.example.com/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/registry.example.com/privkey.pem
   Your cert will expire on 2019-11-19. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot-auto
   again. To non-interactively renew *all* of your certificates, run
   "certbot-auto renew"  
 - If you like Certbot, please consider supporting our work by:  
   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

Problem binding to port 80: Could not bind to IPv4 or IPv6.

Challenge failed for domain registry.example.com
​
IMPORTANT NOTES:
 - The following errors were reported by the server:
​
   Domain: registry.example.com
   Type:   connection
   Detail: dns :: DNS problem: NXDOMAIN looking up A for
   registry.example.com
​
   To fix these errors, please make sure that your domain name was
   entered correctly and the DNS A/AAAA record(s) for that domain
   contain(s) the right IP address. Additionally, please check that
   your computer has a publicly routable IP address and that no
   firewalls are preventing the server from communicating with the
   client. If you're using the webroot plugin, you should also verify
   that you are serving files from the webroot path you provided.

vi /etc/nginx/sites-enabled/registry.example.com

# registry.example.com setting
server {
  # http -> https redirect setting
  listen 80;
  server_name registry.example.com;
  server_tokens off; ## Don't show the nginx version number, a security best practice
  return 301 https://$host$request_uri;
  access_log  /var/log/nginx/registry_access.log access;
  error_log   /var/log/nginx/registry_error.log;
}
server {
  listen 443 ssl http2;
  listen [::]:443 ssl http2;
  server_name registry.example.com;
  # Certificate and key files location
  ssl_certificate            /etc/letsencrypt/live/registry.example.com/fullchain.pem;
  ssl_certificate_key        /etc/letsencrypt/live/registry.example.com/privkey.pem;
  client_max_body_size       2048M; # Change this to the max file size you want to allow
  location / {
    proxy_set_header  Host              $http_host;   # required for docker client's sake
    proxy_set_header  X-Real-IP         $remote_addr; # pass on real client's IP
    proxy_set_header  X-Forwarded-For   $proxy_add_x_forwarded_for;
    proxy_set_header  X-Forwarded-Proto $scheme;
    proxy_read_timeout                  900;
    proxy_pass        http://localhost:5000;
  }
}

mkdir -p registry/auth && cd registry
vi docker-compose.yml

registry:
  restart: always
  image: registry:2
  container_name: registry
  ports:
    - 5000:5000
  environment:
    REGISTRY_AUTH: htpasswd
    REGISTRY_AUTH_HTPASSWD_PATH: /auth/htpasswd
    REGISTRY_AUTH_HTPASSWD_REALM: Registry Realm
  volumes:
    - ./auth:/auth

docker-compose up -d

$ docker-compose ps
  Name                Command               State           Ports
--------------------------------------------------------------------------
registry   /entrypoint.sh /etc/docker ...   Up      0.0.0.0:5000->5000/tcp
​
$ curl https://registry.example.com/v2/_catalog
{"errors":[{"code":"UNAUTHORIZED","message":"authentication required","detail":[{"Type":"registry","Class":"","Name":"catalog","Action":"*"}]}]}

registry:
  restart: always
  image: registry:2
  container_name: registry
  ports:
    - 5000:5000

$ docker run --rm --entrypoint htpasswd registry:2 -Bbn user1 1q2w3e4r >> auth/htpasswd
$ cat auth/htpasswd
user1:$2y$05$DjCZOMqHQ0yE1aV6ydFf2eMb3nn5J1DQCoeYG5cKHjXdXU4SmfjUy

$ docker login registry.example.com
Username: user1
Password:
WARNING! Your password will be stored unencrypted in /root/snap/docker/384/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store
​
Login Succeeded

$ docker pull alpine
Using default tag: latest
latest: Pulling from library/alpine
9d48c3bd43c5: Pull complete
Digest: sha256:72c42ed48c3a2db31b7dafe17d275b634664a708d901ec9fd57b1529280f01fb
Status: Downloaded newer image for alpine:latest
docker.io/library/alpine:latest

$ docker tag alpine registry.example.com/alipine
$ docker ps
REPOSITORY                       TAG                 IMAGE ID            CREATED             SIZE
alpine                           latest              961769676411        33 hours ago        5.58MB
registry.example.com/alipine     latest              961769676411        33 hours ago        5.58MB

$ docker login registry.example.com
Authenticating with existing credentials...
Login Succeeded
$ docker push registry.example.com/alipine
The push refers to repository [registry.example.com/alipine]
03901b4a2ea8: Pushed
latest: digest: sha256:acd3ca9941a85e8ed16515bfc5328e4e2f8c128caa72959a58a127b7801ee01f size: 528

# 현재 저장되어 있는 이미지를 삭제합니다.
$ docker rmi registry.example.com/alipine
Untagged: registry.example.com/alipine:latest
Untagged: registry.example.com/alipine@sha256:acd3ca9941a85e8ed16515bfc5328e4e2f8c128caa72959a58a127b7801ee01f
​
$ docker pull registry.example.com/alipine
Using default tag: latest
latest: Pulling from alipine
Digest: sha256:acd3ca9941a85e8ed16515bfc5328e4e2f8c128caa72959a58a127b7801ee01f
Status: Downloaded newer image for registry.example.com/alipine:latest