Sign inSign up

zebox/registry-admin

By zebox

•Updated over 2 years ago

The UI tool that allows manage access to a private Docker registry

Image
2

6.6K

zebox/registry-admin repository overview

Go Report Card Coverage Status Build Status

The RegistryAdmin is the UI tool that allows users to manage access to a private Docker registry. It provides a web-based user interface for managing repositories, images, and user access, and allows users to authenticate using either password. The main goal of the project is to provide a high-level API for managing user access to a private registry, and to restrict user actions (such as push and pull) for specific repositories based on the official⁠ private Docker registry image⁠. This can be useful for registry owners who want to have more control over their registry and who want to be able to manage access to it more easily.

⁠Features
  • User management and access control for a private registry
  • Restricted access to repository based on user actions (pull/push) for token authentication scheme)
  • List all repositories and images
  • List all tags for a specific image
  • Displaying tag and image data
  • Displaying the history of an image
  • Deleting image tags
  • Sharing anonymous access to specific repositories
  • Sharing access to specific repositories with registered users only
  • A built-in self-signed certificate builder
  • Single binary distribution
  • Distribution as a single binary or Docker container
  • Automatic SSL termination using Let's Encrypt for access to the UI
  • Logging options, including Apache Log Format and simplified stdout reports
⁠Install

RegistryAdmin distributed as a small self-contained binary as well as a docker image. Both binary and image support multiple architectures and multiple operating systems, including linux_x86_64, linux_arm64, linux_arm, macos_x86_64, macos_arm64, windows_x86_64 and windows_arm.

⁠Example

To get started, you will need to set up the required parameters in a docker-compose file or using command line flags. You can find various configuration examples in the _examples⁠ folder.

version: '2.1'
services:
  registry-admin:
    restart: unless-stopped
    image: zebox/registry-admin:master
    ports:
      - 8080:80
    environment:
      - RA_CONFIG_FILE=/app/config/token-ra-config.yml
    volumes:
      - ./certs:/app/certs
      - ./config:/app/config
      - ./data:/app/data

  registry:
    restart: unless-stopped
    image: registry:2
    ports:
      - 50554:5000
    environment:
      - REGISTRY_AUTH_TOKEN_REALM=https://tnas.local:8080/api/v1/auth # <- !!! Change this for real hostname of RegistryAdmin and exposed port which accessible for docker clients
    volumes:
      - ./data:/var/lib/registry
      - ./certs:/certs
      - ./config/registry-config.yml:/etc/docker/registry/config.yml
    depends_on:
      - registry-admin
⁠Options

Each option can be provided in three forms: command line, environment key:value pair or config file (json or yaml formats). Command line options have a long form only, like --hostname=localhost. The environment key (name) listed for each option as a suffix, i.e. [$HOSTNAME].


      --listen:                           listen on host:port (127.0.0.1:80/443 without) (default: *) [$RA_LISTEN]
      --hostname:                         Main hostname of service (default: localhost) [$RA_HOST_NAME]
      --port:                             Main web-service port. Default:80 (default: 80) [$RA_PORT]
      --config-file:                      Path to config file [$RA_CONFIG_FILE]
      --debug                             enable the debug mode [$RA_DEBUG]

registry:
      --registry.host:                    Main host or address to docker registry service [$RA_REGISTRY_HOST]
      --registry.port:                    Port which registry accept requests. Default:5000 (default: 5000) [$RA_REGISTRY_PORT]
      --registry.auth-type:[basic|token]  Type for auth to docker registry service. Available 'basic' and 'token'. Default 'token' (default: token) [$RA_REGISTRY_AUTH_TYPE]
      --registry.login:                   Username is a credential for access to registry service using basic auth type [$RA_REGISTRY_LOGIN]
      --registry.password:                Password is a credential for access to registry service using basic auth type [$RA_REGISTRY_PASSWORD]
      --registry.htpasswd:                Path to htpasswd file when basic auth type selected [$RA_REGISTRY_HTPASSWD]
      --registry.https-insecure           Set https connection to registry insecure [$RA_REGISTRY_HTTPS_INSECURE]
      --registry.service:                 A service name which defined in registry settings [$RA_REGISTRY_SERVICE]
      --registry.issuer:                  A token issuer name which defined in registry settings [$RA_REGISTRY_ISSUER]
      --registry.gc-interval:             Use for define custom time interval for garbage collector execute (minutes), default 1 hours [$RA_REGISTRY_GC_INTERVAL]

certs:
      --registry.certs.path:              A path to directory where will be stored new self-signed cert,keys and CA files, when 'token' auth type is used [$RA_REGISTRY_CERTS_CERT_PATH]
      --registry.certs.key:               A path where will be stored new self-signed private key file, when 'token' auth type is used [$RA_REGISTRY_CERTS_KEY_PATH]
      --registry.certs.public-key:        A path where will be stored new self-signed public key file, when 'token' auth type is used [$RA_REGISTRY_CERTS_PUBLIC_KEY_PATH]
      --registry.certs.ca-root:           A path where will be stored new CA bundles file, when 'token' auth type is used [$RA_REGISTRY_CERTS_CA_ROOT_PATH]
      --registry.certs.fqdn:              FQDN(s) for registry certificates [$RA_REGISTRY_CERTS_FQDN]
      --registry.certs.ip:                Address which appends to certificate SAN (Subject Alternative Name) [$RA_REGISTRY_CERTS_IP]

auth:
      --auth.token-secret:                Main secret for auth token sign [$RA_AUTH_TOKEN_SECRET]
      --auth.jwt-issuer:                  Token issuer signature (default: zebox) [$RA_AUTH_ISSUER_NAME]
      --auth.jwt-ttl:                     Define JWT expired timeout (default: 1h) [$RA_AUTH_JWT_TTL]
      --auth.cookie-ttl:                  Define cookies expired timeout (default: 24h) [$RA_AUTH_COOKIE_TTL]

logger:
      --logger.stdout                     enable stdout logging [$RA_LOGGER_STDOUT]
      --logger.enabled                    enable access and error rotated logs [$RA_LOGGER_ENABLED]
      --logger.file:                      location of access log (default: access.log) [$RA_LOGGER_FILE]
      --logger.max-size:                  maximum size before it gets rotated (default: 10M) [$RA_LOGGER_SIZE]
      --logger.max-backups:               maximum number of old log files to retain (default: 10) [$RA_LOGGER_BACKUPS]

ssl:
      --ssl.type:[none|static|auto]       ssl (auto) support. Default is 'none' (default: none) [$RA_SSL_TYPE]
      --ssl.cert:                         path to cert.pem file [$RA_SSL_CERT]
      --ssl.key:                          path to key.pem file [$RA_SSL_KEY]
      --ssl.acme-location:                dir where certificates will be stored by autocert manager (default: ./acme) [$RA_SSL_ACME_LOCATION]
      --ssl.acme-email:                   admin email for certificate notifications [$RA_SSL_ACME_EMAIL]
      --ssl.port:                         Main web-service secure SSL port. Default:443 (default: 443) [$RA_SSL_PORT]
      --ssl.http-port:                    http port for redirect to https and acme challenge test (default: 80) [$RA_SSL_ACME_HTTP_PORT]
      --ssl.fqdn:                         FQDN(s) for ACME certificates [$RA_SSL_ACME_FQDN]

store:
      --store.type:[embed]                type of storage (default: embed) [$RA_STORE_DB_TYPE]
      --store.admin-password:             Define password for default admin user when storage create first (default: admin) [$RA_STORE_ADMIN_PASSWORD]

embed:
      --store.embed.path:                 Parent directory for the sqlite files (default: ./data.db) [$RA_STORE_EMBED_DB_PATH]

Help Options:
  -?                                     Show this help message
  -h, --help                              Show this help message
⁠Contribution

For contribute or help to this project follow to GitHub⁠

Tag summary

Content type

Image

Digest

sha256:58f128de9…

Size

18.2 MB

Last updated

over 2 years ago

docker pull zebox/registry-admin