Docker registry

[A Former User]

I am both excited about this and confused about where it is at. My endgame is using GitLab to manage containers, but I need to point it at a registry. Would this ultimately work? And is there a way to have auth go through gitlab for this?

[mario]

@atrilahiji it's currently working as a stand-alone registry via basic auth powered by htpasswd file. It'll also support Cloudron SSO shortly, after that I'll work on making it work with GitLab.

[robi]

@mario how's it going?

[mario]

@robi I have managed to integrate the registry with GitLab.

@girish where are we at with making proper MR for AuthProxy + making SSO optional? Then I can document GitLab integration, you can write some tests and off we go!

[girish]

@mario Fantastic news. So, all we need is docs to make it work with GitLab registry or does it need any packages changes to gitlab app or docker registry app ?

[mario]

@girish doesn't seem like it'll need package changes, documentation will be enough.

[mario]

I take that back, I did add some package changes. Had no time to test, but things seem to be working ok from the initial glimpse at it:

https://git.cloudron.io/cloudron/docker-registry-app/-/merge_requests/1

Please test and report back @girish and others

[robi]

Might be useful to add auto deletion of old images:
https://github.com/jeffstephens/retention-manager

[mario]

@robi GitLab does that for me Maybe a separate app?

[girish]

@mario Just looking into this now.

Wondering, what is the best way forward. The app has no UI, but can have a login screen (via proxyAuth). So, when they login, they see a blank screen. Not ideal. Does it make sense to bundle any of the docker uis like https://github.com/Joxit/docker-registry-ui/ ? Seems quite easy to do. I can look into it.

[robi]

@mario that's great, but the standalone private registry app that's coming may need it and as @girish pointed out a simple UI.

Also not everyone is interested in the ruby laden GitLab and all it's complexity.

[mario]

@girish depends on what the community needs. I'm more than happy to have a separate registry + other things as separate apps for those who need it.

If I needed to pick the best registry solution with UI and everything else that's well maintained and suitable for Cloudron, I'd probably look at Quay which supports LDAP auth.

https://github.com/quay/quay

[mehdi]

I am 100% in favor of bundling a simple UI together with the registry. Even if one does not need it and wants to use the gitlab UI, there's basically nothing to lose besides a few kB of storage ^^

[jimcavoli]

Yeah, Quay and Harbor are definitely the big players in this space. Very similar products - harbor is CNCF graduated and Quay is upstream for the corresponding Red Hat product. Either (or both) would be good UI adds.

[girish]

Last I checked harbor was impractical to package (as in way too much effort, it's really geared for the k8s crowd). Quay is a good option, but let me get this basic docker registry out first, I am almost there.

[mario]

@jimcavoli Quay afaik implements the protocol as well, so no need for registry separately.

[girish]

So strange, I am getting a "invalid checksum digest format" whenever I push now to this registry. Has anyone seen such an error before?

The push refers to repository [xxx.xxx.xxx/cloudron/base]
fcdfeda3e242: Layer already exists 
0ea3bde29271: Layer already exists 
d75ccb14b8b6: Layer already exists 
74b4389a43ab: Layer already exists 
5f38ae1e1a63: Layer already exists 
3479c151673d: Layer already exists 
7a307b866f25: Layer already exists 
ce3a66c20e17: Layer already exists 
7197b970ebb9: Layer already exists 
16542a8fc3be: Layer already exists 
6597da2e2e52: Layer already exists 
977183d4e999: Layer already exists 
c8be1b8f4d60: Layer already exists 
invalid checksum digest format

[mario]

@girish local filesystem?

[girish]

@mario Yes, with the local storage. I wonder if it's something to do with the proxy auth. I am trying it without auth now.

edit: indeed, something to do with the proxy auth. It works fine without proxy auth. Debugging.

[mehdi]

@girish Are you on 6.1 ? Maybe your 2FA implementation broke something with the basic auth ?