Project

General

Profile

Actions
Copy link

action #160376

open

Fix container registry on AWS

Added by ph03nix about 2 months ago. Updated 3 days ago.

Status:
Feedback
Priority:
High
Assignee:
ph03nix
Target version:
-
Start date:
2024-05-15
Due date:
% Done:

100%

Estimated time:

Description

Our container registry instance throws HTTP 500 errors since this morning. We need to fix it.

Actions
Copy link
 #1

Updated by rbranco about 2 months ago

  • Priority changed from Urgent to High
  • % Done changed from 0 to 50

Main issue solved.

TODO:

  • Refine script.
Actions
Copy link
 #2

Updated by rbranco about 1 month ago

Also check:

  • Vulnerability to DOS when using docker registry listing tools. (Also investigate docker search)
  • Firewall in place on AWS.
Actions
Copy link
 #3

Updated by rbranco 20 days ago

  • Status changed from In Progress to Feedback

Registry is frozen as of now.

Actions
Copy link
 #4

Updated by rbranco 20 days ago

  • Status changed from Feedback to In Progress

Reopened to apply some kind of firewall in it.

Actions
Copy link
 #6

Updated by rbranco 19 days ago

  • Status changed from In Progress to Feedback
Actions
Copy link
 #7

Updated by rbranco 18 days ago · Edited

  • Status changed from Feedback to In Progress

Reopening.

This time I could prepopulate the mirror with all 4 arches without hitting rate limits using my credentials. Which is weird because the document states that authenticated free users only have twice the limit.

Actions
Copy link
 #8

Updated by ph03nix 18 days ago

  • Assignee changed from rbranco to ph03nix
Actions
Copy link
 #9

Updated by ph03nix 17 days ago · Edited

I could setup a toy setup using the https://registry.suse.com/repositories/suse-registry image:

# /etc/registry/config.yml
---
version: 0.1
log:
  level: info
storage:
  filesystem:
    rootdirectory: /var/lib/docker-registry
  delete:
    enabled: true
http:
  addr: 0.0.0.0:5000
proxy:
  remoteurl: https://registry-1.docker.io
  ttl: 168h

and

podman run --detach --replace -p 5000:5000 --name registry  \
    -v /etc/registry/config.yml:/etc/registry/config.yml:Z,ro \
    -v /var/lib/docker-registry:/var/lib/docker-registry:Z \
    registry.suse.com/suse/registry

This works as a pull-through cache, ~however still anyone is allowed to push to this instance, which is bad~. No that is not allowed, this should work as it is.

Actions
Copy link
 #12

Updated by ph03nix 4 days ago

  • Status changed from In Progress to Feedback
  • % Done changed from 50 to 100

I deployed the podman container to our registry instance. It works for now: https://duck-norris.qe.suse.de/tests/14687

Maybe some test runs need to be restarted, but for now it seems to work. Please report any issues back here or directly to me.

Actions
Copy link
 #13

Updated by ph03nix 3 days ago

https://gitlab.suse.de/qac/bazaar contains now the ansible playbook for setting up the registry instance.

Actions
Copy link

Also available in: Atom PDF