Goal: To have a private, insecure v2 registry available internally for the development of a POC.
Overview:
I have an instance of Ubuntu 14.04 LTS Server tipped up in an OpenStack private cloud. Docker has been installed and is verified running version 1.9.0.
Following the documentation at Registry | Docker Docs I have added the following line in /etc/default/docker:
DOCKER_OPTS="--insecure-registry localhost:5000"
The docker service is then restarted with:
$ service docker stop && service docker start
This alone, so far as I can determine, does not start any registry. As verified by:
root@docker-registry-0:/etc/default# curl --include --request GET http://localhost:5000/v2/
curl: (7) Failed to connect to localhost port 5000: Connection refused
Looking at other bits of the docs, I can start up a registry as a container:
root@docker-registry-0:/etc/default# docker run -d -p 5000:5000 --restart=always --name registry registry:2
0f3b177c79fc90725db7486c4076556e7596dc65ae3caf3e12b6f154b1c46e68
root@docker-registry-0:/etc/default# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
0f3b177c79fc registry:2 "/bin/registry /etc/d" 4 seconds ago Up 4 seconds 0.0.0.0:5000->5000/tcp registry
root@docker-registry-0:/etc/default# curl --include --request GET http://localhost:5000/v2/
HTTP/1.1 200 OK
...
Docker-Distribution-Api-Version: registry/2.0
This allows me to pull, tag, & push local on the server where this is all running. However, what I need is to be able to do is pull and push from another server on our network. With port 5000 verified open, trying to access the registry always results in the same error:
user@machina:~/dev/play/template$ docker push 172.22.0.126:5000/myubuntu
The push refers to a repository [172.22.0.126:5000/myubuntu] (len: 1)
unable to ping registry endpoint https://172.22.0.126:5000/v0/
v2 ping attempt failed with error: Get https://172.22.0.126:5000/v2/: tls: oversized record received with length 20527
v1 ping attempt failed with error: Get https://172.22.0.126:5000/v1/_ping: tls: oversized record received with length 20527
Which is better than when the registry is not running at all which results in:
user@machina:~/dev/play/pi-template$ docker push 172.22.0.126:5000/myubuntu
The push refers to a repository [172.22.0.126:5000/myubuntu] (len: 1)
unable to ping registry endpoint https://172.22.0.126:5000/v0/
v2 ping attempt failed with error: Get https://172.22.0.126:5000/v2/: dial tcp 172.22.0.126:5000: connection refused
v1 ping attempt failed with error: Get https://172.22.0.126:5000/v1/_ping: dial tcp 172.22.0.126:5000: connection refused
I have tried a variety of combinations in both /etc/default/docker and /etc/init.d/docker [exclusive] and have have had no success in getting a insecure registry to run when the daemon starts up. After changes to /etc/defaults/docker the docker service was stopped and started. After changes to /etc/init.d/docker the box was restarted. Some of combinations tried are:
#DOCKER_OPTS="--insecure-registry localhost:5000"
#DOCKER_OPTS="--insecure-registry=localhost:5000"
#DOCKER_OPTS="--insecure-registry 172.22.0.126:5000"
#DOCKER_OPTS="--insecure-registry=172.22.0.126:5000"
#DOCKER_OPTS="--insecure-registry 172.22.0.126:5000"
#DOCKER_OPTS="--insecure-registry=172.22.0.126:5000"
#DOCKER_OPTS="--insecure-registry=172.22.0.126"
#DOCKER_OPTS="--insecure-registry 172.22.0.126"
#DOCKER_OPTS="--insecure-registry=http://172.22.0.126:5000"
#DOCKER_OPTS="--insecure-registry http://172.22.0.126:5000"
…and likely a few other transient combinations that didn’t make the list of commented out values.
So I am hoping I am missing something simple to get an insecure private registry up and visible using docker 1.9.0 and registry v2. Thoughts or links to the right docs would be appreciated. Again my hope is to put together a POC for an on prem dockerized SDLC. I do not wish to violate the will of the community and use an insecure registry once the concepts are proven. Thanks much.
