2. Attach volume name registry-shared to both GitLab and Docker Registry apps. Be sure to uncheck the Read Only checkbox.

I'm not able to figure out, how to attach the bind mount to the running gitlab container and how to uncheck read only checkbox

/opt/registry-shared

1. Create a volume named registry-shared.

2. Attach volume name registry-shared to both GitLab and Docker Registry apps. Be sure to uncheck the Read Only checkbox.

3. Create folders containers and certs on the host filesystem inside the path that is assigned to the registry-shared volume.

4. Run the following commands inside the certs folder:

openssl req -nodes -newkey rsa:2048 -keyout registry-auth.key -out registry-auth.csr -subj "/CN=gitlab-issuer"
openssl x509 -in registry-auth.csr -out registry-auth.crt -req -signkey registry-auth.key -days 365000
chmod 777 registry-auth.key registry-auth.crt registry-auth.csr

5. Modify the permissions from root to cloudron inside the Docker Registry app for the created folders and files.

chown -R cloudron:cloudron /media/registry-shared/

6. Modify /app/data/config.yml of the Docker Registry app using the File manager by altering or adding the auth part to resemble the following:

auth:
  token:
    realm: https://<GITLAB_HOST>/jwt/auth
    service: container_registry
    issuer: gitlab-issuer
    rootcertbundle: /media/registry-shared/certs/registry-auth.crt
Change the 'rootdirectory' value inside the same config file to:


/media/registry-shared/containers
Save the file and restart the app.

7. Modify /app/data/gitlab.yml of the GitLab app by adding the following lines (some of them might already be there, so skip them):

production:
  <<: *base

  registry:
    enabled: true
    host: <DOCKER_REGISTRY_HOST>
    port: 443
    api_url: https://<DOCKER_REGISTRY_HOST>
    key: /media/registry-shared/certs/registry-auth.key
    path: /media/registry-shared/containers
    issuer: gitlab-issuer

1. I have created the directory in the host machine

/opt/registry-shared

3. Created two other folders (containers & certs) in the registry-shared directory

4. Generated keys in certs folders using the following cmd

I'm getting error 500 when making changes to the gitlab.yml file

This most likely means there is an error in the yml syntax. What error do you see in the logs ? You will find more logs in /run/gitlab (via web terminal).

  registry:
    enabled: true
    host: registry.git.arsh.dev
    port: 5005
    api_url: http://localhost:5000/ # internal address to the registry, will be used by GitLab to directly communicate with API
    key: config/registry.key
    path: shared/registry
    issuer: gitlab-issuer

I'm not against Harbor, etc. but I do need this to work which is why I'm on it

Have private code waiting to become a private app and this is a show stopper road block.

I think an alternate approach is get Harbor working. It looks simple enough to deploy since it's a Go app and also has LDAP. This will then work with GitLab CI/CD (nice article). This won't bring in gitlab's auth into the registry though. Are people looking for something like that? (it seems something for big enterprises).

If Gitlab Registry is a seperate service, you could already use Cloudrons ability to configure backup bevavior and storage location. This would be nice for some use cases but not a basic requirement.

PS: For external/cloud storage you could already use MinIO which is available on Cloudron ^^

I migrated most of my custom apps to official cloudron apps (used to do custom WordPress and LAMPs for various reasons and some apps made it to the store), so only a few that aren't released yet (and some probably never will) are left, but those need to be available at all times - did a cloudron version update the other day and realized that the ssl cert of the registry needed a refresh, else the apps couldn't get reconfigured and would be in an erronous state. Would be nice to have a solution on some dev cloudron which handles those images so I don't have to run that single vm with the docker registry.

• Registry stores the images locally on the server itself. If so, we have to figure out how this will get backed up. Is there an interest in backing these things up or are people OK if these container images are "lost" (maybe since it's only used for building things in CI/CD).

• Registry is in another non-cloudron server. My understanding is this deployment is already possible but I have to try.

• Some external service is used as registry (for example, DO recently announced it's managed docker registry). Not sure if GitLab supports this.

Guide what has to be edited can be found --> https://dev.to/zaptic/how-to-gitlab-and-docker-registry-2moh

Edit: Full package documentation --> https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/administration/packages/container_registry.md

As for the port, that would be a manual adjustment of nginx and simpler.

You can uncomment the relevant lines and try it.
Remember to keep it bound to the container & domain.

I'll let @girish chime in if it's been tested.