How to push docker images using a reverse proxy to an artificial

Question

I have a problem with the fact that the image of my docker was artificial [Artifactory Pro Power Pack 3.5.2.1 (rev 30160)] (which is used as a docker registry).

I have a docker version:

$ sudo docker version Client version: 1.5.0 Client API version: 1.17 Go version (client): go1.3.3 Git commit (client): a8a31ef/1.5.0 OS/Arch (client): linux/amd64 Server version: 1.5.0 Server API version: 1.17 Go version (server): go1.3.3 Git commit (server): a8a31ef/1.5.0 

I followed this link http://www.jfrog.com/confluence/display/RTF/Docker+Repositories and this artifactory as a docker-local registry I create a docker-local registry in artifactory called docker-local and enable docker support for it. My artifactory has no option where I can tell docker v1 or v2, as in this document , so I assume that it uses docker v1.

Artifactory created this for me:

 <distributionManagement> <repository> <id>sdpvvrwm812</id> <name>sdpvvrwm812-releases</name> <url>http://sdpvvrwm812.ib.tor.company.com:8081/artifactory/docker-local</url> </repository> <snapshotRepository> <id>sdpvvrwm812</id> <name>sdpvvrwm812-snapshots</name> <url>http://sdpvvrwm812.ib.tor.company.com:8081/artifactory/docker-local</url> </snapshotRepository> </distributionManagement> 

Although something does not work with these settings.

I installed the nginx reverse proxy and copied these settings to my /etc/nginx/nginx.conf :

http {

 ## # Basic Settings ## [...] server { listen 443; server_name sdpvvrwm812.ib.tor.company.com; ssl on; ssl_certificate /etc/ssl/certs/sdpvvrwm812.ib.tor.company.com.crt; ssl_certificate_key /etc/ssl/private/sdpvvrwm812.ib.tor.company.com.key; access_log /var/log/nginx/sdpvvrwm812.ib.tor.company.com.access.log; error_log /var/log/nginx/sdpvvrwm812.ib.tor.company.com.error.log; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Original-URI $request_uri; proxy_read_timeout 900; client_max_body_size 0; # disable any limits to avoid HTTP 413 for large image uploads # required to avoid HTTP 411: see Issue #1486 (https://github.com/docker/docker/issues/1486) chunked_transfer_encoding on; location /v1 { proxy_pass http://sdpvvrwm812.ib.tor.company.com:8081/artifactory/api/docker/docker-local/v1; } } } 

I generated my ssl key as shown at http://www.akadia.com/services/ssh_test_certificate.html and placed in 2 directories

 /etc/ssl/certs/sdpvvrwm812.ib.tor.company.com.crt; /etc/ssl/private/sdpvvrwm812.ib.tor.company.com.key; 

I'm not sure how to ping a new docker registry, but

  sudo docker login -u adrianus -p AT65UTJpXEFBHaXrzrdUdCS -e [e-mail] http://sdpvvrwm812.ib.tor.company.com 

gives this error:

FATA [0000] Response error from daemon: ping v1 attempt failed. Error: Get https://sdpvvrwm812.ib.tor.company.com/v1/_ping : dial tcp 172.25.10.44:443: connection refused. If this private registry only supports HTTP or HTTPS with an unknown CA certificate, add --insecure-registry sdpvvrwm812.ib.tor.company.com for daemon arguments. In the case of HTTPS, if you have access to the CA Certificate registry, there is no need for a flag; just put the CA certificate on /etc/docker/certs.d/sdpvvrwm812.ib.tor.company.com/ca.crt

BUT the certificate /etc/docker/certs.d/sdpvvrwm812.ib.tor.company.com/ca.crt exists so what happens?

 sudo curl -k -uadrianus:AP2pKojAeMSpXEFBHaXrzrdUdCS "https://sdpvvrwm812.ib.tor.company.com" 

gives this error:

 curl: (35) SSL connect error 

I am running a docker client using:

 sudo docker -d --insecure-registry https://sdpvvrwm812.ib.tor.company.com 

Maybe since my docker registry is http://sdpvvrwm812.ib.tor.company.com:8081/artifactory/docker-local , and docker and nginx are looking for http://sdpvvrwm812.ib.tor.company.com:8081/artifactory/docker-local / v1 ?

Any tips on how to get docker to move images to artificial ones?

Answer 1

The <distributionManagement/> is for maven. A bit of a facepalm that Artifactory 3 shows a maven fragment for the Docker repository (fixed in Artifactory 4, you can upgrade), so please ignore it.

As a rule, with Docker you cannot use / artifactory / repoName. This is a Docker limitation, your registry must be hostname: port , without any additional path.

That is why you need to configure a reverse proxy. What you do in your nginx configuration redirects all requests to sdpvvrwm812.ib.tor.company.com:443/v1 to http://sdpvvrwm812.ib.tor.company.com:8081/artifactory/api/docker/docker-local/v1 , which is the right thing.

Note that the certificate location should be /etc/docker/certs.d/sdpvvrwm812.ib.tor.company.com/ , not /etc/ssl/certs/ .