How to secure registry and UI about docker-registry-web HOT 6 CLOSED

Thanks for question, @bergtwvd.

The easiest way to secure both registry and frontend is to use Nginx as reverse proxy.
You can find example configs here.
To enable HTTPS on nginx you need to change Nginx config and supply ssl.key and ssl.cert to the nginx container.

Feel free to ask me if you need further assistance.

from docker-registry-web.

Thanks, I will have a try.
Any good pointer on how to generate these ssl key/cert for nginx?

from docker-registry-web.

There is a good howto on setting up Nginx with free StartSSL certificate: https://finiteheap.com/webdev/2015/12/06/nginx-startssl-aplus.html

from docker-registry-web.

On the end I configured the containers such that only port 443 is accessible from the "outside". port 8080 and 5000 are only accessible on the internal registry-net.
The registry auth realm is set to https://< hostname >:443/api/auth

Docker-file:

version: '2'
services:
  nginx:
    image: nginx:1.10
    ports:
      - 443:443
    volumes:
       - ./conf/nginx:/etc/nginx/conf.d/:ro
    networks:
      - registry-net
    depends_on:
      - registry
      - registry-web
  registry-web:
    image: hyper/docker-registry-web:v0.1.0
    ports:
      - 8080
    volumes:
       - ./conf/registry-web:/conf:ro
       - ./db:/data
    networks:
      - registry-net
    depends_on:
       - registry
  registry:
    image: registry:2.4.1
    ports:
      - 5000
    volumes:
      - ./conf/registry:/etc/docker/registry:ro
      - ./registry:/var/lib/registry
    networks:
      - registry-net

networks:
  registry-net:

from docker-registry-web.

It's better to bind exposed ports to localhost:

ports:
  - 127.0.0.1:8080:8080

ports:
  - 127.0.0.1:5000:5000

Otherwise, docker will assign random ports to them and bind these ports to every host interface.

from docker-registry-web.

I think this issue can be closed, from my point of view it is resolved.

from docker-registry-web.