From 6197ca7b10d7b6c04d48d3094c8a956dfe6b99af Mon Sep 17 00:00:00 2001 From: Olivier Gambier Date: Thu, 27 Aug 2015 11:58:27 -0700 Subject: [PATCH] Adding mirror as a recipe Normalized mirror.md to match other recipes. Slightly tweaked content, emphasizing the privacy concerns about using login/password on the backend. Signed-off-by: Olivier Gambier --- docs/mirror.md | 60 +++++++++++++++++++++++++------------------------ docs/recipes.md | 3 ++- 2 files changed, 33 insertions(+), 30 deletions(-) diff --git a/docs/mirror.md b/docs/mirror.md index 1abd33f2a..34a3d813a 100644 --- a/docs/mirror.md +++ b/docs/mirror.md @@ -1,36 +1,48 @@ # Registry as a pull through cache -A v2 Registry can be configured as a pull through cache. In this mode a Registry responds to all normal docker pull requests but stores all content locally. +## Use-case -NOTE: Currently this feature can only be used to proxy against the official Docker Hub. +If you have multiple instances of Docker running in your environment (e.g., multiple physical or virtual machines, all running the Docker daemon), each time one of them requires an image that it doesn’t have it will go out to the internet and fetch it from the public Docker registry. By running a local registry mirror, you can keep most of the redundant image fetch traffic on your local network. -## Why? +### Alternatives -If you have multiple instances of Docker running in your environment (e.g., multiple physical or virtual machines, all running the Docker daemon), each time one of them requires an image that it doesn’t have it will go out to the internet and fetch it from the public Docker registry. By running a local registry mirror, you can keep most of the image fetch traffic on your local network. +Alternatively, if the set of images you are using is well delimited, you can simply pull them manually and push them to a simple, local, private registry. + +Furthermore, if your images are all built in-house, not using the Hub at all and relying entirely on your local registry is the simplest scenario. + +### Gotcha + +It's currently not possible to mirror another private registry. Only the central Hub can be mirrored. + +### Solution + +The Registry can be configured as a pull through cache. In this mode a Registry responds to all normal docker pull requests but stores all content locally. ## How does it work? The first time you request an image from your local registry mirror, it pulls the image from the public Docker registry and stores it locally before handing it back to you. On subsequent requests, the local registry mirror is able to serve the image from its own storage. -## What if the content changes on the Hub? +### What if the content changes on the Hub? When a pull is attempted with a tag, the Registry will check the remote to ensure if it has the latest version of the requested content. If it doesn't it will fetch the latest content and cache it. -## What about my disk? +### What about my disk? -In environments with high churn rates, stale data can build up in the cache. When running as a pull through cache the Registry will periodically remove old content to save disk space. Subsequent requests for removed content will cause a remote fetch and local re-caching. +In environments with high churn rates, stale data can build up in the cache. When running as a pull through cache the Registry will periodically remove old content to save disk space. Subsequent requests for removed content will cause a remote fetch and local re-caching. To ensure best performance and guarantee correctness the Registry cache should be configured to use the `filesystem` driver for storage. ## Running a Registry as a pull through cache -The easiest way to run a registry as a pull through cache is to run the official Registry pull through cache official image. +The easiest way to run a registry as a pull through cache is to run the official Registry image. Multiple registry caches can be deployed over the same back-end. A single registry cache will ensure that concurrent requests do not pull duplicate data, but this property will not hold true for a registry cache cluster. @@ -38,33 +50,23 @@ Multiple registry caches can be deployed over the same back-end. A single regis To configure a Registry to run as a pull through cache, the addition of a `proxy` section is required to the config file. -In order to access private images on the Docker Hub the username and password can be supplied. +In order to access private images on the Docker Hub, a username and password can be supplied. -``` -proxy: - remoteurl: https://registry-1.docker.io - username: [username] - password: [password] -``` + proxy: + remoteurl: https://registry-1.docker.io + username: [username] + password: [password] +> :warn: if you specify a username and password, it's very important to understand that private resources that this user has access to on the Hub will be made available on your mirror. It's thus paramount that you secure your mirror by implementing authentication if you expect these resources to stay private! - -## Configuring the Docker daemon +### Configuring the Docker daemon You will need to pass the `--registry-mirror` option to your Docker daemon on startup: -``` -docker --registry-mirror=https:// -d -``` + docker --registry-mirror=https:// daemon For example, if your mirror is serving on http://10.0.0.2:5000, you would run: -``` -docker --registry-mirror=https://10.0.0.2:5000 -d -``` - -NOTE: Depending on your local host setup, you may be able to add the --registry-mirror options to the `DOCKER_OPTS` variable in `/etc/default/` docker. - - - + docker --registry-mirror=https://10.0.0.2:5000 daemon +NOTE: Depending on your local host setup, you may be able to add the `--registry-mirror` option to the `DOCKER_OPTS` variable in `/etc/default/docker`. diff --git a/docs/recipes.md b/docs/recipes.md index 275c71f7e..b2a69db10 100644 --- a/docs/recipes.md +++ b/docs/recipes.md @@ -31,4 +31,5 @@ At this point, it's assumed that: * [using Apache as an authenticating proxy](apache.md) * [using Nginx as an authenticating proxy](nginx.md) * [running a Registry on OSX](osx-setup-guide.md) - * [hacking the registry: build instructions](building.md) \ No newline at end of file + * [hacking the registry: build instructions](building.md) + * [mirror the Docker Hub](mirror.md) \ No newline at end of file