2

I've been considering to use my own private docker registry to distribute some of my projects publicly. However, the moment you add an authentication strategy to your registry, you loose public pull access to all its images.

Is there an easy way to tell the registry some images can be anonymously pulled (not pushed, of course) - in the same way https://hub.docker.com/ works?

I've been reading through https://docs.docker.com/registry docs but so far I found nothing on the matter. I guess it's a use case covered in EE Docker Trusted Registry and not included in the community version:

DTR uses Role Based Access Control (RBAC) to allow you to implement fine-grained access control policies for who has access to your Docker images.

1 Answer 1

1

You can check 3rdparty Registry projects that allow fine grain access like Portus or Harbor, I use harbor and the projects set as public can be pulled anonymously

2
  • Yeah, I was looking at the most-starred "docker registry" projects on github and that two names popped up among the list. How is your instance of Harbor performance-wise? I was looking for something lightweight since I don't need that many options, but I guess it's also worth checking.
    – Alfageme
    Oct 19, 2017 at 7:01
  • What's the mechanism that allows harbor to do this? What I observe in my own attempts is that docker pull first pings registry.example.com/v2. If I require auth on that endpoint, the pull fails (even if the ultimate image could be pulled without auth). If I do not require auth on /v2/, then the pull of a private image fails, because the client does not provide credentials (even if it has them for that registry) because the /v2/ ping did not require auth.
    – Patrick
    Nov 18, 2021 at 18:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.