Private Registry inside PaaS

Private Registry inside PaaS

A private Docker registry allows you to store and distribute proprietary or confidential container images without publishing them through a public image repository.

The registry can be deployed as a custom container inside the platform. After configuration, Docker images can be pushed from a local machine and later deployed to platform environments from the private repository.

On this page

Deploy Private Registry

The official registry image is available through Docker Hub and can be deployed as a custom container in the platform.

1Create a new environment

Sign in to the platform and click New Environment in the top toolbar.

2Select the registry image

Open the Docker tab in the topology wizard, click Select Image, search for the registry image, and add it to the environment.

Image tag: Select the required registry tag during image selection or in the next configuration step.

3Configure the environment

Set the disk limit, environment name, region, resource limits, and other required options. Click Create and wait while the environment is provisioned.

Version note: This workflow is intended for Docker Registry 2.x and newer. Deprecated registry versions can require a different configuration and interaction flow.

Configure External Access

The registry listens on private port 5000. Create an endpoint to expose this port externally.

4Add an endpoint

Open the environment Settings, navigate to Endpoints, and add a new endpoint. Set the Private Port to 5000.

The created endpoint becomes the registry entry point used in Docker commands.

Alternative: A public IP address can be attached to the container and used directly instead of an endpoint.

Add an Image to the Registry

The following example pulls an existing image from Docker Hub, tags it for the private registry, and pushes it to the new repository. A locally created image can also be used.

5Check Docker installation

Install Docker CE on the local machine when it is not already available. Confirm the Docker daemon version using:

docker -v

The source guide requires Docker daemon version 1.6.0 or newer.

6Pull and tag the image

Pull the required image and tag it with the registry entry point and repository name:

docker pull {image} && docker tag {image} {entry_point}/{repository}
  • {image} — the Docker image to pull and tag, for example jelastic/haproxy.
  • {entry_point} — the endpoint or public IP assigned to the private registry.
  • {repository} — the repository name inside the private registry, for example haproxy.

Secure Registry Communication

Remote private-registry communication should be protected with TLS. Install a server key and domain certificate issued by a recognised certificate authority.

A self-signed certificate can also be used, but each Docker daemon that connects to the registry must be configured to trust it.

Testing only: The registry can be configured as insecure and accessed over plain HTTP. This is not recommended for production use.

For a temporary insecure-registry setup, add the following option to the local Docker daemon configuration, such as /etc/default/docker:

DOCKER_OPTS="--insecure-registry {entry_point}"
The same trust or insecure-registry configuration must be applied to every Docker daemon that needs to access the private registry.

Push the Image

Restart the local Docker daemon and push the tagged image to the registry:

sudo service docker restart
docker push {entry_point}/{repository}

Upload time depends on the image size and the available Internet connection speed. After the push is complete, the image can be deployed in the platform as a custom container from the private registry.

What’s next?