WIP initial version #1

misterbisson · 2016-10-11T22:56:43Z

automatic config templating
choice of storage drivers: filesystem or s3
Nginx proxy
Let's Encrypt support
~~Support for traditional SSL certs, in addition to Let's Encrypt~~ (depends on Patterns for injecting SSL certificate and key nginx#38, cutting from MVP)
Password-protected with basic http auth per example (future version might implement other auth schemes)

Here's an example of what's expected in the _env file:

# HTTP secret must be same among all instances of the same registry
HTTPSECRET=<a secret shared by all instances>

# Set the storage driver; `filesystem` and `s3` are supported
STORAGEDRIVER=filesystem

# Let's Encrypt details
ACME_ENV=production
ACME_DOMAIN=<a domain name that's CNAME'd to the CNS service name for Nginx>

# Consul discovery via Triton CNS
CONSUL=docker-registry-consul.svc.<user uuid>.<data center>.cns.joyent.com

Here's an example of the S3 config, if that's used instead of STORAGEDRIVER=filesystem:

# Set the storage driver; `filesystem` and `s3` are supported
STORAGEDRIVER=s3

# S3 bucket and access details
S3ACCESSKEY=<string|key>
S3SECRETKEY=<string|key>
S3REGION=<string|region>
S3BUCKET=<string|bucket name>

insecure no auth no s3 just local storage

twhiteman · 2016-10-13T20:02:43Z

nginx/etc/nginx/nginx-ssl.conf.ctmpl

+    ## In the case of nginx performing auth, the header will be unset
+    ## since nginx is auth-ing before proxying.
+    map $upstream_http_docker_distribution_api_version $docker_distribution_api_version {
+        'registry/2.0' '';


This seems to set the header to:

docker-distribution-api-version: registry/2.0, \

which then confuses sdc-docker when checking against this header (sdc-docker uses this to see if the registry supports v2).

Good catch. d6468fb fixed this down on line 67:

- add_header 'Docker-Distribution-Api-Version' \$docker_distribution_api_version always; + add_header 'Docker-Distribution-Api-Version' $docker_distribution_api_version always;

misterbisson · 2016-10-26T16:50:49Z

If we don't care about LE challenges, we could add a firewall rule like this to allow sdc-docker and imgapi for Triton Cloud:

$ triton fwrule create -D "sdc-docker private registry access" 'FROM (ip 165.225.134.21 OR ip 165.225.134.27 OR ip 165.225.148.4 OR ip 165.225.164.15 OR ip 165.225.164.6 OR ip 165.225.172.28 OR ip 165.225.172.6 OR ip 199.192.240.203 OR ip 199.192.240.41 OR ip 37.153.102.26 OR ip 37.153.102.30 OR ip 8.19.32.41) TO tag "triton.cns.services" = docker-registry-nginx ALLOW tcp (PORT 80 AND PORT 443)'

misterbisson · 2016-11-02T05:19:10Z

etc/containerpilot.json

+    {
+      "name": "docker-registry",
+      "port": 5000,
+      "health": "true",


This could be, um, better...er, more effective.

even just a GET /v2/ will hit the API Version Check so that we know the registry is listening.

tgross · 2016-11-08T18:07:18Z

README.md

+# Optional Docker user info
+# This supports a single user/password pair.
+# More complex use-cases can be built using this as a base image.
+# These generated strings might be a good user/password combo for your registry


Could the comments clarify this a bit for end-user uses? Something more like "doing X and Y is how you would have your Docker client login"? And/or include links to what piece of the registry auth we're implementing here?

tgross · 2016-11-08T18:09:54Z

README.md

+[![DockerPulls](https://img.shields.io/docker/pulls/autopilotpattern/docker-registry.svg)](https://registry.hub.docker.com/u/autopilotpattern/docker-registry/)
+[![DockerStars](https://img.shields.io/docker/stars/autopilotpattern/docker-registry.svg)](https://registry.hub.docker.com/u/autopilotpattern/docker-registry/)
+
+### Hello world example


I feel like the README is missing a description of the components and how they interact; stating plainly that a Nginx container is proxying to the Registry container, whether connectivity between the Nginx container and Registry is encrypted, etc.

geek · 2016-11-08T18:10:44Z

README.md

+### Hello world example
+
+1. [Get a Joyent account](https://my.joyent.com/landing/signup/) and [add your SSH key](https://docs.joyent.com/public-cloud/getting-started).
+1. Install the [Docker Toolbox](https://docs.docker.com/installation/mac/) (including `docker` and `docker-compose`) on your laptop or other environment, as well as the [Joyent Triton CLI](https://docs.joyent.com/public-cloud/api-access/cloudapi).


Install Docker (includes docker-compose and docker-machine)

tgross · 2016-11-08T18:10:49Z

README.md

+S3BUCKET=<your s3 bucket>
+```
+
+### "It doesn't do X"


Maybe ### Contributing? This feels a little "PRs welcome nyah nyah" to me

tgross · 2016-11-08T18:14:52Z

nginx/etc/containerpilot.json

+      "timeout": "10m"
+    }{{ end }}
+  ]
+}


You've got a missing line-ending/EOF on a few files. I'd recommend fixing this in your editor settings b/c it can cause issues when trying to text-manipulate source files.

tgross · 2016-11-08T18:16:27Z

bin/manage.sh

+until
+    cmd=$1
+    if [ -z "$cmd" ]; then
+        onChange


There's no onChange handler in this file. Given there's a single command here maybe we should just cut all the command parsing? Or even just put the consul-template call into the containerpilot.json?

tgross · 2016-11-08T18:19:01Z

docker-compose.yml

+registry:
+  image: autopilotpattern/docker-registry:latest
+  restart: always
+  mem_limit: 128m


Have we tested this with larger image layers? I'm worried large image layers don't end up getting streamed in-memory without giant chunks because, well, I don't trust upstream not to foul that up. 😀

tgross · 2016-11-08T18:29:11Z

nginx/etc/nginx/nginx.conf.ctmpl

+            proxy_set_header    X-Forwarded-For    $proxy_add_x_forwarded_for;
+            proxy_set_header    X-Forwarded-Proto  $scheme;
+            proxy_read_timeout                     900;
+        }{{ end }}


Generally speaking I like adding an {{ else }} block here to return a 503. And in this case it tells the Docker client "hey no backends are available and shit's broken" instead of returning 404 which tells the client that we simply don't implement v2 of the spec

geek · 2016-11-08T18:57:44Z

docker-compose.yml

+  mem_limit: 128m
+  env_file: _env
+  expose:
+    - 53


No need to expose many of these ports if we don't recommend using them.

tgross · 2017-01-31T18:46:04Z

Given that one needs to use DNS to talk to the registry anyways (both for TLS and the namespacing), should this be replaced by the work in https://github.com/joyent/product-automation/tree/master/registry?

tgross · 2017-02-08T13:44:28Z

Closing in lieu of #7

misterbisson and others added 14 commits October 11, 2016 15:32

wip

462ae7f

ports be ports

a266594

no consul agent in local compose

43d4551

rename

64df9d1

it's a template, dangit

cf9cdfb

any port in a...wtf

0786466

end-to-end working

fcbbf84

insecure no auth no s3 just local storage

working s3 and storage switching

46bc326

first pass at ssl template

2d21e62

ack my acme

66f12c5

ack my acme v2

3bf11b3

don't forget to open the door

4b3158f

rearranging deck chairs

9be9026

bring in the logging improvements

9f4b461

twhiteman reviewed Oct 13, 2016

View reviewed changes

fix stray slashes

d6468fb

misterbisson added 9 commits October 30, 2016 09:06

consolidated nginx.conf template

b3495ba

resolve conflicts

5a3c2b0

be gone, dangit

b792406

first pass at implementing user/pass

e09f839

permisions, of course

0b612a6

don't forget to add that script, yall

d260afb

get it right, dangit

c5e9793

don't use key_exists, eliminate second log_format

86842f7

...almost...

9e83f6d

This was referenced Nov 1, 2016

Support user-provided SSL cert #2

Open

Add support for multiple users #3

Open

misterbisson added 2 commits November 2, 2016 06:12

batten down hatches

23eb51b

initial version of setup script

9b31d3a

misterbisson added 4 commits November 2, 2016 06:46

Dockerfile polish

b31c04b

initial readme

6147867

corrected consul CNS name

e3d8bd2

moving the images to the autopilotpattern namespace

402d270

misterbisson commented Nov 2, 2016

View reviewed changes

tgross reviewed Nov 8, 2016

View reviewed changes

geek reviewed Nov 8, 2016

View reviewed changes

tgross reviewed Nov 8, 2016

View reviewed changes

README.md

S3BUCKET=<your s3 bucket>

```

### "It doesn't do X"

Copy link

tgross Nov 8, 2016

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe ### Contributing? This feels a little "PRs welcome nyah nyah" to me

tgross reviewed Nov 8, 2016

View reviewed changes

geek reviewed Nov 8, 2016

View reviewed changes

docker-compose.yml

mem_limit: 128m

env_file: _env

expose:

- 53

Copy link

geek Nov 8, 2016

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No need to expose many of these ports if we don't recommend using them.

tgross closed this Feb 8, 2017

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

WIP initial version #1

WIP initial version #1

misterbisson commented Oct 11, 2016 •

edited

Loading

twhiteman Oct 13, 2016

misterbisson Oct 18, 2016

misterbisson commented Oct 26, 2016 •

edited

Loading

misterbisson Nov 2, 2016

tgross Nov 8, 2016

tgross Nov 8, 2016 •

edited

Loading

tgross Nov 8, 2016

geek Nov 8, 2016 •

edited

Loading

tgross Nov 8, 2016

tgross Nov 8, 2016

tgross Nov 8, 2016 •

edited

Loading

tgross Nov 8, 2016

tgross Nov 8, 2016 •

edited

Loading

geek Nov 8, 2016

tgross commented Jan 31, 2017

tgross commented Feb 8, 2017

WIP initial version #1

WIP initial version #1

Conversation

misterbisson commented Oct 11, 2016 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

misterbisson commented Oct 26, 2016 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tgross Nov 8, 2016 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

geek Nov 8, 2016 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tgross Nov 8, 2016 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tgross Nov 8, 2016 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tgross commented Jan 31, 2017

tgross commented Feb 8, 2017

misterbisson commented Oct 11, 2016 •

edited

Loading

misterbisson commented Oct 26, 2016 •

edited

Loading

tgross Nov 8, 2016 •

edited

Loading

geek Nov 8, 2016 •

edited

Loading

tgross Nov 8, 2016 •

edited

Loading

tgross Nov 8, 2016 •

edited

Loading