‫Docker Registry. We've previously discussed how it can be a registry that you store privately on your
‫network.
‫It's actually part of the Docker/distribution GitHub repo.
‫If you went looking for Registry, just so you know, there's an old version of Registry in GitHub
‫that is legacy. It'll clearly say that. The current V2 Registry that we're all using was rewritten in
‫Go and can be found in the Distribution code repository but you probably won't use it from GitHub,
‫you'll probably use it from Docker Hub. Docker has a pre-built official image for Registry,
‫so it's as simple as Docker pull registry. I would say that it's pretty much the defacto backend
‫registry for storing your containers privately.
‫It is pretty bare bones.
‫There's no web GUI.
‫It's definitely not like a Docker Hub or other third party service. Out-of-the-box,
‫it does support certificates and basic authentication, but they're not enabled by default and the authentication
‫is actually everything or none.
‫It's not RBAC or role-based access control.
‫It's more like an Apache htaccess where, if you have a username and password that you get through, you
‫have read/write access to everything.
‫It's probably only useful in small teams without some sort of tool on top of it to make it more enterprise-y
‫and scalable.
‫But at its core, it's really just a web API and a storage system to handle all of these large images
‫we're going to be dealing with.
‫The nice thing is it actually comes with a lot of built in storage drivers that allow you to put
‫the backend storage of it on S3 or Azure or Alibaba or Google Cloud. It's even got an OpenStack
‫Swift driver but we're just going to use the local which is default.
‫Basically, that just means using the local file system in the image or on your host using volumes.
‫Real quick, before we get to installing the registry, I wanted to bring your attention to a few of
‫the resource links in this section that you should check out.
‫The first one is a basic set up with TLS so that you won't have to enable the insecure registry
‫option because, obviously, TLS is a good thing.
‫The second is a reference article from Docker around a garbage collection.
‫The thing about a registry is when you start using it in the real world, it really starts to take
‫up a lot of data and, especially if you're pushing images over and over, it can really start to eat up
‫disk space.
‫So you need to pay a little bit of attention to your decision around your storage driver and, as
‫well,
‫this article on garbage collection which will try to clean up old things and keep your storage in check.
‫Lastly, a really cool option is the registry mirror.
‫If you're deploying to production and one of your concerns is that you don't want to depend on the
‫Hub for a lot of your base images, then what you can do as a feature in Registry is to enable a proxy
‫mode and then you tell your Docker daemons to use the proxy and what it will do is it will cache any
‫Hub images inside that registry. Which is pretty great if you're wanting to make sure that you can optimize
‫your bandwidth in case you've maybe got dozens or hundreds of servers, you definitely don't want to be
‫downloading the Ubuntu image on every single machine from the Hub.
‫Right?
‫So you could have this proxy much more closer to your metal, and then it also would provide some failover
‫in case the Hub would have issues.
‫You can still get your copies of the images locally.