Explore the Basics of setting up your first secure Private Docker Registry This is a Title Slide with Graphic slide ideal for including a picture with a brief title, subtitle and presenter information. Do not customize this slide with your own background. Mike Raab Senior Principal Product Manager Oracle Container Cloud Service March 8, 2017

Program Agenda 1 About Me It Starts with the VM Key Tools on the Road of SSL Certificates Docker Run Q&A 2 3 4 5

About Me 30 plus years in x86 compute industry 20 plus years in software I Internet 10 years in Virtualization |Cloud | SaaS | IaaS 3 years working with Docker Current - Product Manager at Oracle for Container Cloud Service

Let’s Build a Secure Private Docker Image Registry Oracle Cloud VM – OL6 UEK4 + Open SSH / HTTPS Ports + Docker Engine + Valid SSL Certs

Install / Verify Docker Engine on OL6

Docker Engine is Installed

Create DNS A Record In Your CPanel

Third Party Tools To Be Used Acme.sh (https://github.com/Neilpang/acme.sh) Tool to interact with Let’s Encrypt Supports a variety of modes, including DNS Supports Oracle Linux Let’s Encrypt (https://letsencrypt.org) Free and open Certificate Authority MX Toolbox (https://mxtoolbox.com) Used to check DNS Propagation

Install Acme.sh https://github.com/Neilpang/acme.sh

Use Acme.sh DNS Method $ acme.sh --issue --dns -d registry.example.com

Add Text Record in CPanel

Check that TXT record has propagated DNS

Request Certs $ acme.sh --renew -d registry.example.com

Copy Certs to /home/opc/certs $ acme.sh --renew -d registry.example.com * https://docs.docker.com/registry/deploying/#get-a-certificate

Prep and Docker Run $ cd /home/opc $ docker pull registry:2 $ mkdir auth $ docker run --entrypoint htpasswd registry:2 -Bbn testuser testpassword > auth/htpasswd $ docker run -d --restart=always -p=443:5000/tcp - e="REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt" - e="REGISTRY_HTTP_TLS_KEY=/certs/registry.example.com.key" -e="REGISTRY_AUTH=htpasswd" - e="REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd" -e="REGISTRY_AUTH_HTPASSWD_REALM=Our Test Registry" -v=/home/opc/certs:/certs -v=/home/opc/auth:/auth -v /home/opc/registry:/var/lib/registry "registry:2"

Login to Registry and Push Test Image

Verify in Browser

Validate in Oracle Container Cloud Service

Key Links and Content Content Location This Presentation is based on this Blog: https://community.oracle.com/community/cloud_computing/infrastructure-as-a-service-iaas/oracle-container-cloud-service/blog/2017/01/26/the-fast-path-to-a-private-docker-registry-on-oracle-public-cloud More Information on Oracle Public Cloud Infrastructure: https://cloud.oracle.com/en_US/iaas More Information on Oracle Container Cloud Service: https://cloud.oracle.com/en_US/container

Questions?

Add a UI via Docker Compose registry: restart: always image: registry:2 ports: - 443:5000 environment: REGISTRY_HTTP_TLS_CERTIFICATE: /certs/domain.crt REGISTRY_HTTP_TLS_KEY: /certs/registry.example.com.key REGISTRY_AUTH: htpasswd REGISTRY_AUTH_HTPASSWD_PATH: /auth/htpasswd REGISTRY_AUTH_HTPASSWD_REALM: Example Registry volumes: - /home/opc/certs:/certs - /home/opc/auth:/auth - /home/opc/registry:/var/lib/registry ui: image: konradkleine/docker-registry-frontend:v2 - 8443:443 extra_hosts: - "registry.example.com:172.17.0.1" ENV_DOCKER_REGISTRY_HOST: registry.example.com ENV_DOCKER_REGISTRY_PORT: 443 ENV_DOCKER_REGISTRY_USE_SSL: 1 ENV_USE_SSL: 1 - /home/opc/certs/domain.crt:/etc/apache2/server.crt:ro - /home/opc/certs/registry.example.com.key:/etc/apache2/server.key:ro