Getting Started with Artifactory as a Docker Registry

Getting Started with Artifactory Cloud

Using Docker repositories withArtifactory Cloudis quick and easy. With Artifactory Cloud, you are using Artifactory as a hosted service and there is no need to configure Artifactory with a reverse proxy.

The example at the end of this section shows a complete process of creating a Docker repository, logging in, pulling an image and pushing an image.

Using Docker Client with Artifactory Cloud

To use the Docker client with one of your Artifactory Cloud Docker repositories, you can use the native Docker client to login to each Docker repository, pull, and push images.

• Log in to your repository use the following command with your Artifactory Cloud credentials.

  docker login ${server-name}.jfrog.io

• Pull an image using the following command.

  docker pull ${server-name}.jfrog.io/{repo-name}/

• Push an image by first tagging it and then using the push command.

  docker tag  ${server-name}.jfrog.io/{repo-name}/ docker push ${server-name}.jfrog.io/{repo-name}/

Test Your Setup

The following example demonstrates the following scenario:

• Pulling thehello-worldDocker image
• Logging into your virtual Docker repository
• Retagging thehello-worldimage, and then pushing it into your virtual Docker repository

1. Start by creating avirtual Docker repositorycalleddockerv2-virtual.

2. Pull thehello-worldimage

   docker pull hello-world

3. Log in to repositorydockerv2-virtual

   docker login acme-dockerv2-virtual.jfrog.io

4. Tag thehello-worldimage

   docker tag hello-world acme-dockerv2-virtual.jfrog.io/hello-world

5. Push the taggedhello-worldimage todockerv2-virtual

   docker push acme-dockerv2-virtual.jfrog.io/hello-world

Getting Started with Artifactory Pro On-Prem

The Docker client has the following two limitations:

1. You cannot use a context path when providing the registry path (e.glocalhost:8082/artifactoryis not valid)
2. Docker will only send basic HTTP authentication when working against an HTTPS host or when using theinsecure registryflag

Artifactory offers solutions to these limitations allowing you to create and use any number of Docker registries.

• Using a reverse proxy
  When used, a reverse proxy, maps Docker commands to one of the multiple Docker registries in Artifactory
• Without a reverse proxy
  从5.8版本,使用Docke Artifactory支持r without the use of a reverse proxy allowing you to create and use multiple Docker registries in Artifactory out-of-the-box.

Using a Reverse Proxy

When using Artifactory with a reverse proxy, you need to map Docker commands to Docker registries in Artifactory using either thesubdomain method,ports methodorrepository path method.

With the ports method, a port number is mapped to each Artifactory Docker registry. While this is an easy way to get started, you will need to modify your reverse proxy configuration and add a new mapping for each new Docker registry you define in Artifactory. In addition, firewalls and other restrictions by your IT department may restrict port numbers making the ports method not feasible.

With the subdomain method, you only need to configure your reverse proxy once, and from then on, the mapping from Docker commands to Docker registries in Artifactory is dynamic and requires no further modification of your reverse proxy configuration.

The repository path method allows a single point of entry (URL) to access different repositories. This is done by embedding the name of the repository being accessed into the image path.

If a wildcard certificate is available, we recommend the subdomain method since it will only require a one time effort and follows Docker convention more closely.

The Subdomain Method

Getting started with Docker and your on-prem Artifactory Pro installation using the subdomain method involves four basic steps:

1. Configuring Artifactory

2. Configuring your reverse proxy

3. Configuring your Docker client

4. Testing your setup

Configuring Artifactory

To configure Artifactory and your reverse proxy using the subdomain method, carry out the following steps:

1. Make sure Artifactory isup and running, and isactivated with a valid license.
2. Create yourvirtual Docker repository(as well as a local and remote Docker repository that it should aggregate). In our example below we will use a repository nameddocker-virtual.
3. Make sure you have a reverse proxy server up and running.

4. Obtain awildcardSSL certificate or use a wildcard self-signed certificate. To create a self-signed certificate, you can followthese instructions for Ubuntu.
   

   Make sure your certificate matches theArtifactory hostnameused in your reverse proxy configuration. In our example below we will useart.local.

Configuring Your Reverse Proxy

Artifactory's can generate your complete reverse proxy configuration file for supported servers.

Go toReverse Proxy Configuration Generatorand fill in the fields in according to how your reverse proxy is set up while making sure to:

1. Use the correctArtifactory hostnamein thePublic Server Namefield (in our example this will beart.local)
2. SelectSubdomainas theReverse Proxy MethodunderDocker Reverse Proxy Settings.
   

Nginx

Copy the code snippet generated by theconfiguration generatorinto yourartifactory-nginx.conffile, and place it in your/etc/nginx/sites-available目录中。
Create the following symbolic link.

sudo ln -s /etc/nginx/sites-available/artifactory-nginx.conf /etc/nginx/sites-enabled/artifactory-nginx.conf

Apache HTTPD

Copy the code snippet generated by theconfiguration generatorinto yourartifactory-apache.conffile and place it in your/etc/apache2/sites-available目录中。

Create the following symbolic link:

sudo ln -s /etc/apache2/sites-available/artifactory-apache.conf /etc/apache2/sites-enabled/artifactory-apache.conf

# Apache libraries location (should be tuned) Define APACHE_LIB_DIR /usr/lib/apache2/modules <---- Input fied in UI could be great # Apache Logs (default : beside other Artifactory logs) Define APACHE_LOG_DIR /[TheArtifactoryHome]/logs <---- ErrorLog/CustomLog could be uncommented & Input fied in UI could be great LoadModule proxy_module ${APACHE_LIB_DIR}/mod_proxy.so LoadModule rewrite_module ${APACHE_LIB_DIR}/mod_rewrite.so LoadModule proxy_ajp_module ${APACHE_LIB_DIR}/mod_proxy_ajp.so LoadModule proxy_http_module ${APACHE_LIB_DIR}/mod_proxy_http.so LoadModule ssl_module ${APACHE_LIB_DIR}/mod_ssl.so <---- Only if HTTPS used Listen 443 <---- Only if HTTPS used Listen XXX <--- All port used as Docker registry

Configuring Your Docker Client

To configure your Docker client, carry out the following steps

1. Add the following to your DNS or to the client's/etc/hostsfile:

    docker-virtual.art.local

2. Since the certificate is self-signed, you need to import it to your Docker certificate trust store as described in theDocker documentation. Alternatively, you can configure the Docker client to work with an insecure registry as described in theDocker documentation.

   
   

3. Restart your Docker daemon/engine to apply the insecure registry flag (if self-signed certificate is imported, you do not need to restart the Docker daemon/engine).

Test Your Setup

To verify your reverse proxy is configured correctly, run the following command making sure that the return code is 200:

curl -I -k -v https:///api/system/ping

运行以下命令,以确保你的代理公司nfiguration is functional and can communicate with Artifactory:

• Pull the "hello-world" image

  docker pull hello-world

• Login to repository docker-virtual

  docker login docker-virtual.art.local

• Tag the "hello-world" image

  docker tag hello-world docker-virtual.art.local/hello-world

• Push the tagged "hello-world" image to docker-virtual

  docker push docker-virtual.art.local/hello-world

The Repository Path Method

Getting started with Docker and your on-prem Artifactory Pro installation using the path method involves four basic steps:

1. Configuring Artifactory

2. Configuring your reverse proxy

3. Configuring your Docker client

4. Testing your setup

Configuring Artifactory

To configure Artifactory and your reverse proxy using the path method, carry out the following steps:

1. Make sure Artifactory isup and running, and isactivated with a valid license.
2. Create yourVirtual Docker Repositories(as well as a local and remote Docker repository that it should aggregate). In our example below we will use a repository nameddocker-virtual.
3. Make sure you have a reverse proxy server up and running.

4. Obtain a valid SSL certificate or use a self-signed certificate. To create a self-signed certificate, you can followthese instructions for Ubuntu.
   

   Make sure your certificate matches theArtifactory hostnameused in your reverse proxy configuration. In our example below we will useart.local.

Configuring your reverse proxy

Artifactory's can generate your complete reverse proxy configuration file for supported servers.

Go toReverse Proxy Configuration Generatorand fill in the fields in according to how your reverse proxy is set up while making sure to:

1. Use the correctArtifactory hostnamein thePublic Server Namefield (in our example this will beart.local)
2. SelectRepository Pathas theReverse Proxy MethodunderDocker Reverse Proxy Settings.
   

Nginx
Copy the code snippet generated by theconfiguration generatorinto yourartifactory-nginx.conffile, and place it in your/etc/nginx/sites-available目录中。
Create the following symbolic link.

sudo ln -s /etc/nginx/sites-available/artifactory-nginx.conf /etc/nginx/sites-enabled/artifactory-nginx.conf

Apache HTTPD

Copy the code snippet generated by theconfiguration generatorinto yourartifactory-apache.conffile and place it in your/etc/apache2/sites-available目录中。

Create the following symbolic link:

sudo ln -s /etc/apache2/sites-available/artifactory-apache.conf /etc/apache2/sites-enabled/artifactory-apache.conf

Configuring Your Docker Client

To configure your Docker client, carry out the following steps

1. Add the following to your DNS or to the client's/etc/hostsfile:

    art.local

2. Since the certificate is self-signed, you need to import it to your Docker certificate trust store as described in theDocker documentation. Alternatively, you can configure the Docker client to work with an insecure registry as described in theDocker documentation.

   
   

3. Restart your Docker daemon/engine to apply the insecure registry flag (if self-signed certificate is imported, you do not need to restart the Docker daemon/engine).

Test Your Setup

To verify your reverse proxy is configured correctly, run the following command making sure that the return code is 200:

curl -I -k -v https:///api/system/ping

运行以下命令,以确保你的代理公司nfiguration is functional and can communicate with Artifactory:

• Pull the "hello-world" image

  docker pull hello-world

• Login to repository docker-virtual

  docker login art.local

• Tag the "hello-world" image

  docker tag hello-world art.local/docker-virtual/hello-world

• Push the tagged "hello-world" image to docker-virtual

  docker push art.local/docker-virtual/hello-world

端口的方法

Getting started with Docker and your on-prem Artifactory Pro installation using the ports method involves two basic steps:

1. Configuring Artifactory and your reverse proxy.

2. Configuring your Docker client.

Configuring Artifactory and Your Reverse Proxy

To configure Artifactory and your reverse proxy using the ports method, carry out the following steps:

1. Make sure Artifactory isup and running, and is activated with a valid license.
2. Create yourVirtual Docker Registry(as well as a local and remote Docker repository that it should aggregate). In our example below we will use a repository nameddocker-virtual.
3. Make sure you have a reverse proxy server up and running.

4. Obtain an SSL certificate or use a Self-Signed certificate that can be generated following this example.

   Make sure your certificate matches theArtifactory hostnameused in your reverse proxy configuration. In our example below we will useart.local.

5. Configure your reverse proxy. Artifactory'sReverse Proxy Configuration Generatorcan generate your complete reverse proxy configuration file for supported servers. All you need to do is fill in the fields in according to how your reverse proxy is set up while making sure to:
   1. Use the correctArtifactory hostnamein thePublic Server Namefield
   2. SelectPortsas theReverse Proxy MethodunderDocker Reverse Proxy Settings. In the example below, we will use port5001to bind repositorydocker-virtual.

   NGINX

   For Artifactory to work with Docker, the preferred web server isNGINX v1.3.9and above.
   First, you need to create a self-signed certificate for NGINXas described here for Ubuntu.
   Then use Artifactory'sReverse Proxy Configuration Generatorto generate the configuration code snippet for you.
   Copy the code snippet into yourartifactory-nginx.conffile and place it in your/etc/nginx/sites-available目录中。
   Finally, create the following symbolic link:

   sudo ln -s /etc/nginx/sites-available/artifactory-nginx.conf /etc/nginx/sites-enabled/artifactory-nginx.conf

   
   Apache HTTPD

   Install Apache HTTP server as a reverse proxyand then install therequired modules.

   Create the following symbolic link:

   sudo ln -s /etc/apache2/mods-available/slotmem_shm.load /etc/apache2/mods-enabled/slotmem_shm.load

   Similarly, create corresponding symbolic links for:

   • headers
   • proxy_balancer
   • proxy_load
   • proxy_http
   • proxy_connect
   • proxy_html
   • rewrite.load
   • ssl.load
   • lbmethod_byrequests.load
   
   Then use Artifactory'sReverse Proxy Configuration Generatorto generate the configuration code snippet for you.
   Copy the code snippet into yourartifactory.conffile and place it in your/etc/apache2/sites-available目录中。
   

   HAProxy

   
   First, you need to create a self-signed certificate for HAProxyas described here for Ubuntu.

   Then, copy the code snippet below into your/etc/haproxy/haproxy.cfgfile. After editing the file as described in the snippet, you can test your configuration using the following command:

   haproxy -f /etc/haproxy/haproxy.cfg -c

   HAProxy v1.5 Configuration Expand source

   # haproxy服务器配置# # 1.0版本tory # --------------------------------------------------------------------------- # Features enabled by this configuration # HA configuration # port 80, 443 Artifactory GUI/API # # This uses ports to distinguish artifactory docker repositories # port 443 docker-virtual (v2) docker v1 is redirected to docker-dev-local. # port 5001 docker-prod-local (v1); docker-prod-local2 (v2) # port 5002 docker-dev-local (v1); docker-dev-local2 (v2) # # Edit this file with required information enclosed in <...> # 1. certificate and key # 2. artifactory-host # 3 replace the port numbers if needed # ---------------------------------------------------------------------------- global log 127.0.0.1 local0 chroot /var/lib/haproxy maxconn 4096 user haproxy group haproxy daemon tune.ssl.default-dh-param 2048 stats socket /run/haproxy/admin.sock mode 660 level admin defaults log global mode http option httplog option dontlognull option redispatch option forwardfor option http-server-close maxconn 4000 timeout connect 5000 timeout client 50000 timeout server 50000 errorfile 400 /etc/haproxy/errors/400.http errorfile 403 /etc/haproxy/errors/403.http errorfile 408 /etc/haproxy/errors/408.http errorfile 500 /etc/haproxy/errors/500.http errorfile 502 /etc/haproxy/errors/502.http errorfile 503 /etc/haproxy/errors/503.http errorfile 504 /etc/haproxy/errors/504.http frontend normal bind *:80 bind *:443 ssl crt  mode http option forwardfor reqirep ^([^\ :]*)\ /v2(.*$) \1\ /artifactory/api/docker/docker-virtual/v2\2 reqadd X-Forwarded-Proto:\ https if { ssl_fc } option forwardfor header X-Forward-For default_backend normal # if only need to access the docker-dev-local2 then skip this section. Docker-virtual can be configured to deploy to docker-dev-local2 frontend dockerhub bind *:5000 ssl crt  mode http option forwardfor option forwardfor header X-Forward-For reqirep ^([^\ :]*)\ /v2(.*$) \1\ /artifactory/api/docker/docker-remote/v2\2 reqadd X-Forwarded-Proto:\ https if { ssl_fc } default_backend normal # if only need to access the docker-dev-local2 then skip this section. Docker-virtual can be configured to deploy to docker-dev-local2 frontend dockerprod bind *:5001 ssl crt  mode http option forwardfor option forwardfor header X-Forward-For reqirep ^([^\ :]*)\ /v1(.*$) \1\ /artifactory/api/docker/docker-prod-local/v1\2 reqirep ^([^\ :]*)\ /v2(.*$) \1\ /artifactory/api/docker/docker-prod-local2/v2\2 reqadd X-Forwarded-Proto:\ https if { ssl_fc } default_backend normal # if only need to access the docker-dev-local2 then skip this section. Docker-virtual can be configured to deploy to docker-dev-local2 frontend dockerdev bind *:5002 ssl crt  mode http option forwardfor option forwardfor header X-Forward-For reqirep ^([^\ :]*)\ /v1(.*$) \1\ /artifactory/api/docker/docker-dev-local/v1\2 reqirep ^([^\ :]*)\ /v2(.*$) \1\ /artifactory/api/docker/docker-dev-local2/v2\2 reqadd X-Forwarded-Proto:\ https if { ssl_fc } default_backend normal # Artifactory Non HA Configuration # i.e server artifactory 198.168.1.206:8082 # backend normal mode http server  : # # Artifactory HA Configuration # Using default failover interval - rise = 2; fall =3 3; interval - 2 seconds # backend normal # mode http # balance roundrobin # option httpchk OPTIONS / # option forwardfor # option http-server-close # appsession JSESSIONID len 52 timeout 3h # server  : # server  :

Configuring Your Docker Client

To configure your Docker client, carry out the following steps

1. Add the following to your DNS or to the client's/etc/hostsfile:

    art.local

2. Since the certificate is self-signed, you need to import it to your Docker certificate trust store as described in theDocker documentation. Alternatively, you can configure the Docker client to work with an insecure registry by adding the following line to your/etc/default/dockerfile (you may need to create the file if it does not already exist):

   DOCKER_OPTS="$DOCKER_OPTS --insecure-registry art.local:5001"

3. Restart your Docker engine.

Test Your Setup

To verify your reverse proxy is configured correctly, run the following command:

// Make sure the following results in return code 200 curl -I -k -v https:///api/system/ping

运行以下命令,以确保你的代理公司nfiguration is functional and can communicate with Artifactory. In this example, we will pull down a Docker image, tag it and then deploy it to our ourdocker-virtualrepository that is bound toport 5001:

// Pull the "hello-world" image docker pull hello-world // Login to repository docker-virtual docker login art-local:5001 // Tag the "hello-world" image docker tag hello-world art-local:5001/hello-world // Push the tagged "hello-world" image to docker-virtual docker push art-local:5001/hello-world

Testing With a Self-signed Certificate

1. Since the certificate is self-signed, you need to import it to your Docker certificate trust store as described in theDocker documentation. Alternatively, you can configure the Docker client to work with an insecure registry as described in theDocker documentation.

2. Restart your Docker daemon/engine to apply the insecure registry flag (if self-signed certificate is imported, you do not need to restart the Docker daemon/engine).
   Running$docker infowill list the Insecure registries that have been applied under the Insecure Registries entry.

3. Use the steps above to interact with the Artifactory Docker Registry

Without a Reverse Proxy

Previously, Artifactory supported the Ports and Subdomain methods described above when using a reverse proxy. Fromversion 5.8.Artifactory introduces a new method referred to as the "Repository Path" method since it uses the the Docker repository path prefix () to access a specific Artifactory Docker registry from the Docker client. Note that you may still have a reverse proxy configured for Artifactory for other reasons, however when configured to use Repository Path method, requests to Docker registries in Artifactory will be handled by Artifactory's embedded Tomcat instead of the reverse proxy.

Configuring Artifactory

To configure Artifactory to use the Repository Path method, carry out the following steps:

1. Make sure Artifactory isup and running, and is activated with a valid license.

2. Create yourvirtual Docker repository(as well as a local and remote Docker repository that it should aggregate). In our example below we will use a repository nameddocker-virtual.

3. Go to theHTTP Settingspage from theAdministrationmodule underArtifactory | General | HTTP Settings.
   In theDocker Settingspanel, selectRepository Pathas the Docker Access Method.
   In theReverse Proxy Settingspanel selectEmbedded Tomcatas theServer Provider (which indicates you're not using a reverse proxy).

   You must use Embedded Tomcat

   You can only use Artifactory as a Docker registry without a reverse proxy by using the internal embedded Tomcat.

   
   

Configuring Your Docker Client

Using the Repository Path method, you can work with Artifactory as a Docker registry without a reverse proxy on an insecure connection (i.e. only HTTP is supported, not HTTPS).您需要配置码头工人客户机with an insecure registryas described in theDocker documentation.

Restart your Docker daemon/engine to apply the insecure registry flag (if self-signed certificate is imported, you do not need to restart the Docker daemon/engine). Running$docker infowill list the Insecure registries that have been applied under the Insecure Registries entry.

Test Your Setup

The code snippets below assume you have a virtual Docker repository nameddocker-virtualin an Artifactory installation at IP 10.1.16.114.

First, you should verify that your Docker client can access Artifactory by run the following command. Making sure that the return code is 200:

curl -I -k -v http://10.1.16.114:8082/artifactory/api/system/ping

Now you can proceed to test your Docker registry.

• Login to Artifactory as your Docker registry

  docker login -u admin -p password 10.1.16.114:8082

• Pull thehello-worldimage from thedocker-virtualrepository

  docker pull 10.1.16.114:8082/docker-virtual/hello-world:latest

• Tag a Docker image

  docker tag 10.1.16.114:8082/docker-virtual/hello-world:latest 10.1.16.114:8082/docker-virtual/

• Push the tagged image todocker-virtual

  docker push 10.1.16.114:8082/docker-virtual/