DIY Private Container Registry
Márk Sági-Kazár
2024-02-03 @ FOSDEM ’24
whoami
Márk Sági-Kazár
Head of Open Source @ OpenMeter
CNCF Ambassador
Let me tell you a story…
Requirements
- Share container images with design partners
- Target environments
- developer machine
- CI
- container orchestrator
- → Flexible authentication and authorization
- Minimize operational burden (monitoring, backup, etc)
CNCF Landscape
Source: https://landscape.cncf.io/card-mode?category=container-registry&grouping=category
Available solutions
Cloud-hosted
P2P
All-in-one solutions
Plain old registries
Cloud-hosted registries
- Pros
- Easy to set up
- No operational burden
- Cons
- Requires cloud provider account
- Manual IAM setup
New requirements
- No cloud provider registration required
- Flexible authorization (eg. entitlement-based)
Back to research
Cloud-hosted
P2P
All-in-one solutions
Plain old registries
All-in-one solutions
JFrog
Quay (wasn’t open source at the time)
Portus (unmaintained)
Harbor
Harbor
- Structures artifacts into projects
- Robot accounts for service-to-service auth
- Simple authorization
- Image replication
- Uses Distribution as a registry
Harbor quirks and cons
- Group based access for users, but not for robot accounts
- Cross-project robot account creation requires admin access
- API integration only works with the admin credentials
- Complex software for a specific use case
- Operation is not trivial
New requirements
- Self-serve portal
- Closer integration with sales and licensing systems
Maybe it’s time to build our own solution.
How do container registries work?
OCI
OCI
Docker registry auth “specification”
aka. docker login
- Token based authorization
- OAuth2 protocol
Let’s put it all together
Plain old registries
- Distribution
- Zot
Distribution
- Reference Docker registry implementation
- Major providers rely on it
https://github.com/distribution/distribution
Zot
A production-ready vendor-neutral OCI-native container image registry (purely based on OCI Distribution Specification)
Registry auth is currently broken(fixed!)
Portward
- Registry auth library and service
- Build your own with the library
- Use an existing integration with the service
- ⚠️ Work in progress!
https://github.com/portward/registry-auth
https://github.com/portward/portward
Registry auth caveats
- Not a formal specification
- There are several gaps in it
- Competing, but incompatible specs (eg. ChartMuseum Auth)
- Partial implementations
Future: OCI Auth spec
- OCI Auth working group
- Fairly new (first meeting: August 1, 2023)
Thank you
Any questions?
DIY Private Container Registry Márk Sági-Kazár 2024-02-03 @ FOSDEM ’24