User Tools

Site Tools


services:docker-mirror

docker-mirror.front.sepia.ceph.com

Summary

This is a VM in RHEV that is a caching mirror for docker.io. We were being rate-limited by docker.io (https://tracker.ceph.com/issues/45343).

I was originally going to create an Ansible playbook to set this up but it was easy enough it wasn't worth the time.

https://docs.docker.com/registry/recipes/mirror/

Setup Commands

## On reesi001
ceph auth add client.containers mds 'allow rw path=/containers' mon 'allow r' osd 'allow rw pool=data'
ceph auth get client.containers
# Copy the key output

## On docker-mirror.front.sepia.ceph.com
wget -q -O- 'https://download.ceph.com/keys/release.asc' | sudo apt-key add -
apt update
apt install ceph-common
mkdir /lrc
echo "172.21.2.201,172.21.2.202,172.21.2.203:/containers/mirror    /lrc/           ceph    name=containers,secretfile=/etc/ceph/secret,_netdev 0 2" >> /etc/fstab
echo "KEY_FROM_REESI001" > /etc/ceph/secret 
mount -a
apt install docker.io
docker run -it --rm --entrypoint cat registry:2 /etc/docker/registry/config.yml > /lrc/config.yml
# Used example from https://www.cloudkb.net/configure-docker-local-registry-proxy-cache/

# Then used parts of https://medium.com/@ifeanyiigili/how-to-setup-a-private-docker-registry-with-a-self-sign-certificate-43a7407a1613
mkdir /lrc/certs
openssl req  -newkey rsa:4096 -nodes -sha256 -keyout /lrc/certs/domain.key -x509 -out /lrc/certs/domain.crt

docker run -d --restart=always -p 5000:5000 --name registry-mirror -e REGISTRY_HTTP_TLS_CERTIFICATE=/var/lib/registry/certs/domain.crt -e REGISTRY_HTTP_TLS_KEY=/var/lib/registry/certs/domain.key -v /lrc:/var/lib/registry registry:2 /var/lib/registry/config.yml

Super simple.

Using the mirror

# Example using grafana
podman pull --tls-verify=false docker-mirror.front.sepia.ceph.com:5000/grafana/grafana
services/docker-mirror.txt · Last modified: 2020/11/18 14:21 by djgalloway