Hacker News Reader

Comment by lgbr | Hacker News Reader

Setting up a private repository is a PITA? It's one command:

  docker run -p 5000:5000 registry

Want to back it with S3 or another storage provider? It's still one command:

  docker run -e SETTINGS_FLAVOR=s3 -e AWS_BUCKET=acme-docker -e STORAGE_PATH=/registry -e AWS_KEY=AKIAHSHB43HS3J92MXZ -e AWS_SECRET=xdDowwlK7TJajV1Y7EoOZrmuPEJlHYcNP2k4j49T -e SEARCH_BACKEND=sqlalchemy -p 5000:5000 registry

What's so pain in the ass about this?

View on HN

Yes I have ran that command, I have docker registry running, then I wanted to clean that port and so I put nginx infront and let it proxypass... and have a onename alias for the host that serves the registry so its used by all the machines.

But then you see the hostname is confused for username by docker. Argh crap so it cant be clean, at least has to have fqdn. Or port number.

Its stuff like this man. Documentation should say it "we dont want you to use other registry than ours docker.io its possible but nah". Another issue is, how would you set to use private repo by default? Hm? And never hit docker.io?

+1.

The private registry story is horrible in docker. You have to tag your image with your registry's FQDN, which is an absolutely braindead idea. It's nice to default to docker.io in the absence of options, but I should really be able to do "docker pull --registry myregistry.local ubuntu:latest" and have it work. Instead I have to do "docker pull myregistry.local/ubuntu", which pulls the image and tags it as "myregistry.local/ubuntu". Great, now my registry FQDN is in my image tag. For any decent automation now you have to re-tag it without the "myregistry.local" so you don't depend on your registry FQDN everywhere. But then you better remember to re-tag it with your registry before you push!

In our case we wrote an HDFS driver for the registry so we could store images everywhere, and a service discovery layer to discover registry endpoints (using a load balancer just plain didn't work.) It's an unholy nightmare (but at least we've automated it) to continually re-tag images to go to the endpoint you want.

did you just post your s3 secret key?

I was wondering, too..

According to google, this isn't the first time that key was posted. It's here[1] too.

[1]: https://pypi.python.org/pypi/docker-registry/0.7.3

No, it's an example from the readme: https://github.com/docker/docker-registry#quick-start

It's faster to type the question than it was to look it up, like you did. Thanks for spending the time doing so!

In fact, it comes from the Docker GitHub page https://github.com/docker/docker-registry/tree/master

We should not be too harsh with people who inadvertently post their secret key. They may be very nice, well-meaning, smart people who, you know, make a mistake and post their key. Maybe it is in an environment file, and they post it to their public github. Could happen. Maybe they forgot and went to sleep, and found out their key got jacked. Maybe -- hypothetical here -- someone ran up $1000s of dollars producing bitcoins on this innocent person's account who made one mistake. One tiny mistake. You never know.

Not sure you are talking to me, but my comment wasn't harsh at all. Just trying to make sure he noticed and fixed it in case it was his real key.

No, I was talking about a "friend" of mine who got himself in trouble.

Reply on news.ycombinator.com