@@ -36,7 +36,7 @@ Otherwise, the Container Registry is not enabled. To enable it:
...
@@ -36,7 +36,7 @@ Otherwise, the Container Registry is not enabled. To enable it:
- You can configure it for [a different domain](#configure-container-registry-under-its-own-domain).
- You can configure it for [a different domain](#configure-container-registry-under-its-own-domain).
The Container Registry works under HTTPS by default. You can use HTTP
The Container Registry works under HTTPS by default. You can use HTTP
but it's not recommended and is out of the scope of this document.
but it's not recommended and is beyond the scope of this document.
Read the [insecure Registry documentation](https://docs.docker.com/registry/insecure/)
Read the [insecure Registry documentation](https://docs.docker.com/registry/insecure/)
if you want to implement this.
if you want to implement this.
...
@@ -77,7 +77,7 @@ Where:
...
@@ -77,7 +77,7 @@ Where:
| `issuer` | This should be the same value as configured in Registry's `issuer`. Read the [token auth configuration documentation](https://docs.docker.com/registry/configuration/#token). |
| `issuer` | This should be the same value as configured in Registry's `issuer`. Read the [token auth configuration documentation](https://docs.docker.com/registry/configuration/#token). |
A Registry init file is not shipped with GitLab if you install it from source.
A Registry init file is not shipped with GitLab if you install it from source.
Hence, [restarting GitLab](../restart_gitlab.md#installations-from-source)will not restart the Registry should
Hence, [restarting GitLab](../restart_gitlab.md#installations-from-source)does not restart the Registry should
you modify its settings. Read the upstream documentation on how to achieve that.
you modify its settings. Read the upstream documentation on how to achieve that.
At the **absolute** minimum, make sure your [Registry configuration](https://docs.docker.com/registry/configuration/#auth)
At the **absolute** minimum, make sure your [Registry configuration](https://docs.docker.com/registry/configuration/#auth)
...
@@ -101,7 +101,7 @@ If `auth` is not set up, users can pull Docker images without authentication.
...
@@ -101,7 +101,7 @@ If `auth` is not set up, users can pull Docker images without authentication.
There are two ways you can configure the Registry's external domain. Either:
There are two ways you can configure the Registry's external domain. Either:
-[Use the existing GitLab domain](#configure-container-registry-under-an-existing-gitlab-domain).
-[Use the existing GitLab domain](#configure-container-registry-under-an-existing-gitlab-domain).
The Registry listens on a port and reuse GitLab's TLS certificate.
The Registry listens on a port and reuses GitLab's TLS certificate.
-[Use a completely separate domain](#configure-container-registry-under-its-own-domain) with a new TLS certificate
-[Use a completely separate domain](#configure-container-registry-under-its-own-domain) with a new TLS certificate
for that domain.
for that domain.
...
@@ -113,16 +113,15 @@ for the first time.
...
@@ -113,16 +113,15 @@ for the first time.
### Configure Container Registry under an existing GitLab domain
### Configure Container Registry under an existing GitLab domain
If the Registry is configured to use the existing GitLab domain, you can
If the Registry is configured to use the existing GitLab domain, you can
expose the Registry on a port so that you can reuse the existing GitLab TLS
expose the Registry on a port. This way you can reuse the existing GitLab TLS
certificate.
certificate.
Assuming that the GitLab domain is `https://gitlab.example.com` and the port the
If the GitLab domain is `https://gitlab.example.com` and the port to the outside world is `5050`, here is what you need to set
Registry is exposed to the outside world is `5050`, here is what you need to set
in `gitlab.rb` or `gitlab.yml` if you are using Omnibus GitLab or installed
in `gitlab.rb` or `gitlab.yml` if you are using Omnibus GitLab or installed
GitLab from source respectively.
GitLab from source respectively.
Ensure you choose a port different than the one that Registry listens to (`5000` by default),
Ensure you choose a port different than the one that Registry listens to (`5000` by default),
If you want to store your images on the filesystem, you can change the storage
If you want to store your images on the filesystem, you can change the storage
path for the Container Registry, follow the steps below.
path for the Container Registry, follow the steps below.
This path is accessible to:
This path is accessible to:
...
@@ -377,7 +376,7 @@ driver for the Container Registry.
...
@@ -377,7 +376,7 @@ driver for the Container Registry.
CAUTION: **Warning:**
CAUTION: **Warning:**
GitLab does not back up Docker images that are not stored on the
GitLab does not back up Docker images that are not stored on the
filesystem. Enable backups with your object storage provider if
filesystem. Enable backups with your object storage provider if
desired.
desired.
**Omnibus GitLab installations**
**Omnibus GitLab installations**
...
@@ -436,7 +435,7 @@ you can pull from the Container Registry, but you cannot push.
...
@@ -436,7 +435,7 @@ you can pull from the Container Registry, but you cannot push.
1. Optional: To reduce the amount of data to be migrated, run the [garbage collection tool without downtime](#performing-garbage-collection-without-downtime).
1. Optional: To reduce the amount of data to be migrated, run the [garbage collection tool without downtime](#performing-garbage-collection-without-downtime).
1. This example uses the `aws` CLI. If you haven't configured the
1. This example uses the `aws` CLI. If you haven't configured the
CLI before, you have to configure your credentials by running `sudo aws configure`.
CLI before, you have to configure your credentials by running `sudo aws configure`.
Because a non-admin user likely can't access the Container Registry folder,
Because a non-administrator user likely can't access the Container Registry folder,
ensure you use `sudo`. To check your credential configuration, run
ensure you use `sudo`. To check your credential configuration, run
[`ls`](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3/ls.html) to list
[`ls`](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3/ls.html) to list
all buckets.
all buckets.
...
@@ -468,14 +467,14 @@ you can pull from the Container Registry, but you cannot push.
...
@@ -468,14 +467,14 @@ you can pull from the Container Registry, but you cannot push.