While running an unrestricted registry is certainly ok for development, secured local networks, or test setups, you should probably implement access restriction if you plan on making your registry available to a wider audience or through public internet.
The Registry supports two different authentication methods to get your there:
* direct authentication, through the use of a proxy
* delegated authentication, redirecting to a trusted token server
The first method is recommended for most people as the most straight-forward solution.
The second method requires significantly more investment, and only make sense if you want to fully configure ACLs and more control over the Registry integration into your global authorization and authentication systems.
## Direct authentication through a proxy
With this method, you implement basic authentication in a reverse proxy that sits in front of your registry.
Since the Docker engine uses basic authentication to negotiate access to the Registry, securing communication between docker engines and your proxy is absolutely paramount.
While this model gives you the ability to use whatever authentication backend you want through a secondary authentication mechanism implemented inside your proxy, it also requires that you move TLS termination from the Registry to the proxy itself.
Below is a simple example of secured basic authentication (using TLS), using nginx as a proxy.
### Requirements
You should have followed entirely the basic [deployment guide](deployement.md).
If you have not, please take the time to do so.
At this point, it's assumed that:
* you understand Docker security requirements, and how to configure your docker engines properly
* you have installed Docker Compose
* you have a `domain.crt` and `domain.key` files, for the CN `myregistrydomain.com` (or whatever domain name you want to use)
* these files are located inside the current directory, and there is nothing else in that directory
* it's HIGHLY recommended that you get a certificate from a known CA instead of self-signed certificates
* be sure you have stopped and removed any previously running registry (typically `docker stop registry && docker rm registry`)
### Setting things up
Read again the requirements.
Ready?
Run the following:
```
mkdir auth
mkdir data
# This is the main nginx configuration you will use
cat <<EOF> auth/registry.conf
upstream docker-registry {
server registry:5000;
}
server {
listen 443 ssl;
server_name myregistrydomain.com;
# SSL
ssl_certificate /etc/nginx/conf.d/domain.crt;
ssl_certificate_key /etc/nginx/conf.d/domain.key;
# disable any limits to avoid HTTP 413 for large image uploads
client_max_body_size 0;
# required to avoid HTTP 411: see Issue #1486 (https://github.com/docker/docker/issues/1486)
chunked_transfer_encoding on;
location /v2/ {
# Do not allow connections from docker 1.5 and earlier
# docker pre-1.6.0 did not properly set the user agent on ping, catch "Go *" user agents
