sharenet/registry

Docker Registry Configuration

This folder contains the configuration files for the Docker Registry setup used in the CI/CD pipeline.

Files

• docker-compose.registry.yml: Docker Compose configuration for the registry and Caddy reverse proxy
• Caddyfile: Caddy configuration for HTTPS and authentication
• config.yml: Docker Registry configuration file
• README.md: This documentation file

Architecture

The registry setup uses:

• Docker Registry: Basic registry for storing Docker images
• Caddy: Reverse proxy with automatic HTTPS and authentication
• Environment Variables: For authentication credentials
• Service User: The registry and Caddy services run as the existing CI_SERVICE_USER (not a separate registry user)

Authentication Model

• Pulls: Unauthenticated (public read access)
  • /v2/*/blobs/* - Download image layers
  • /v2/*/manifests/* - Download image manifests
  • /v2/_catalog - List repositories
  • /v2/*/tags/list - List image tags
• Pushes: Require authentication with registry-user credentials
  • /v2/*/blobs/uploads/* - Upload image layers
  • /v2/*/manifests/* (PUT/POST/PATCH/DELETE) - Upload/update manifests

Security Features

• URL-based access control: Different paths require different authentication levels
• Method-based restrictions: Push operations require authentication
• Path validation: Prevents method spoofing by validating both URL patterns and HTTP methods
• Security headers: X-Content-Type-Options, X-Frame-Options for additional protection

Configuration

The setup is configured through:

1. Environment Variables: Stored in .env file (created during setup)
2. Caddyfile: Handles HTTPS and authentication
3. Docker Compose: Orchestrates the registry and Caddy services
4. Registry Config: config.yml contains the Docker Registry configuration
5. User/Permissions: All files and services are owned and run by CI_SERVICE_USER for consistency and security

Usage

The registry is automatically set up during the CI/CD pipeline setup process. The configuration files are copied from this folder to the registry server and customized with the appropriate IP address and credentials. All files and running services should be owned by CI_SERVICE_USER.

Security

• Authentication is handled by Caddy using environment variables
• HTTPS is automatically managed by Caddy
• Registry data is persisted in Docker volumes
• Environment file contains sensitive credentials and should be properly secured
• All files and services are owned by CI_SERVICE_USER (not a separate registry user)