Installing Private Docker Registry

Installing private docker registry for off-line use

This is in preparation for installing off-line Elastic Cloud Enterprise. 

References

https://docs.docker.com/registry/deploying/#run-the-registry-as-a-service

https://hackernoon.com/create-a-private-local-docker-registry-5c79ce912620

https://support.citrix.com/article/CTX135602

https://stackoverflow.com/questions/31251356/how-to-get-a-list-of-images-on-docker-registry-v2

Preparation

This setup requires 3 servers

1. Server A: internet connected where we'll gather our source docker images
2. Server B: Off-line, where we'll host our Docker private registry
3. Server C: Off-line, where we'll pull from our Server B's registry

We assume that you have local repo that is available to download Docker software. 

Setup

On all three servers

1. (Optional) If you don't have RHEL subscription, you'll need to add CentOS-extras
1. Create this file: /etc/yum.repos.d/centos.repo
2. Add this content to it:
   

   [CentOS-extras]
   name=CentOS-7-Extras
   mirrorlist=http://mirrorlist.centos.org/?release=7&arch=$basearch&repo=extras&infra=$infra
   #baseurl=http://mirror.centos.org/centos/$releasever/extras/$basearch/
   gpgcheck=0
   gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7
   

2. Disable SELINUX (if you don't disable, you have to permit Docker to register port)
1. Go to this file: /etc/selinux/config
2. Update this line:
   

   SELINUX=permissive
   

3. (Optional) Disable IPTABLES - you can also just open up ports for Docker use
   

   chkconfig iptables off
   service iptables stop
   

4. Install Docker from Repo
   

   yum install docker
   

5. Enable Docker service
   

   sudo systemctl enable docker.service
   

6. Start Docker Services
   

   sudo systemctl start docker.service
   

7. To check status
   

   sudo systemctl status docker.service
   

On Server A (with internet connection)

1. Pull down necessary images
   

   docker pull registry-1.docker.io/distribution/registry:2.0
   docker pull docker.elastic.co/cloud-enterprise/elastic-cloud-enterprise:1.1.4
   docker pull docker.elastic.co/cloud-assets/elasticsearch:6.3.0-0
   docker pull docker.elastic.co/cloud-assets/kibana:6.3.0-0
   

2. Save all the images to current directory
   

   docker save -o registry2.docker registry-1.docker.io/distribution/registry:2.0
   docker save -o ece_1.1.4.docker docker.elastic.co/cloud-enterprise/elastic-cloud-enterprise:1.1.4
   docker save -o es_6.3 docker.elastic.co/cloud-assets/elasticsearch:6.3.0-0
   docker save -o kibana_6.3.docker docker.elastic.co/cloud-assets/kibana:6.3.0-0
   

3. If you've made any error, you can delete images via this command you can provide individual image ID or clear all
   

   docker rmi $(docker images -a -q)
   

4. You can list all images via this command
   

   docker images
   

5. Transfer these .docker files to Server B

On Server B (without internet connection)

1. Load all the .docker files
   

   docker load -i registry2.docker
   docker load -i ece_1.1.4.docker
   docker load -i es_6.3.docker
   docker load -i kibana_6.3.docker

2. Create Self-Signed Cert
1. Prepare Cert Configure file
2. Create a new file: /etc/ssl/mycert.conf
3. Paste this content and update according to your situation
   

   [req]
   distinguished_name = req_distinguished_name
   x509_extensions = v3_req
   prompt = no
   [req_distinguished_name]
   C = US
   ST = VA
   L = SomeCity
   O = MyCompany
   OU = MyDivision
   CN = www.company.com
   [v3_req]
   keyUsage = keyEncipherment, dataEncipherment
   extendedKeyUsage = serverAuth
   subjectAltName = @alt_names
   [alt_names]
   DNS.1 = www.company.net
   DNS.2 = company.net
   IP.1 = 10.10.10.10
   

3. Go to /etc/ssl and run this command
   

   openssl req -x509 -nodes -days 730 -newkey rsa:2048 -keyout mycert.private -out mycert.cert -config mycert.conf -extensions 'v3_req'
   

4. Move these 2 new files (private and cert) into cert sub-folder (/etc/ssl/certs)
5. Start the registry
   

   1 2 3 4 5 6 7 8 9

   sudo docker run -d \ --restart=always \ --name registry \ -v /etc/ssl/certs:/certs \ -e REGISTRY_HTTP_ADDR=0.0.0.0:443 \ -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/mycert.cert \ -e REGISTRY_HTTP_TLS_KEY=/certs/mycert.private \ -p 443:443 \ registry:2

1. Line 3: Name of this new registry
2. Line 4: associates /etc/ssl/certs of host to the Docker container
6. Few helpful commands
1. Status of Registry
   

   sudo docker ps -a
   

2. Stop Registry
   

   sudo docker container stop registry
   

3. Delete Registry
   

   sudo docker rm CONTAINER_ID
   

7. Tag all the available images
   

   docker tag docker.elastic.co/cloud-enterprise/elastic-cloud-enterprise:1.1.4 10.10.10.10:443/cloud-enterprise/elastic-cloud-enterprise:1.1.4
   docker tag docker.elastic.co/cloud-assets/elasticsearch:6.3.0-0 10.10.10.10:443/cloud-assets/elasticsearch:6.3.0-0
   docker tag docker.elastic.co/cloud-assets/kibana:6.3.0-0 10.10.10.10:443/cloud-assets/kibana:6.3.0-0
   

8. Push the tagged images
   

   docker push 10.10.10.10:443/cloud-enterprise/elastic-cloud-enterprise:1.1.4
   docker push 10.10.10.10:443/cloud-assets/elasticsearch:6.3.0-0
   docker push 10.10.10.10:443/cloud-assets/kibana:6.3.0-0
   

On Server C: Non-internet, non private registry

1. Create a new folder under /etc/docker/certs.d/ use the same name as the host:port of Server B
   

   mkdir /etc/docker/certs.d/10.10.10.10:443
   

2. Copy mycert.cert from Server B (step 4 above) to directory and call it ca.crt
3. Pull from Private Registry
   

   docker pull 10.10.10.10:443/cloud-enterprise/elastic-cloud-enterprise:1.1.4
   

4. Result
   

   605ce1bd3f31: Pull complete
   8319863bba65: Pull complete

5. API Calls: you can also do this to interact with Private Registry
1. Look up all available images
   

   https://10.10.10.10/v2/_catalog
   
   Output
   
   {
   "repositories":[
    "cloud-assets/elasticsearch",
    "cloud-assets/kibana",
    "cloud-enterprise/elastic-cloud-enterprise"]
   }
   

2. Get details on an image
   

   https://10.10.10.10/v2/cloud-assets/kibana/tags/list
   
   Output
   
   {
   "name":"cloud-assets/kibana",
   "tags":["6.3.0-0"]
   }