Create Private Docker Registry (base on Nexus3)

![priavte-banner.jpg](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/144058/c67a1994-7fc8-d2e3-6cba-31909fef4974.jpeg)
> I will share how to create an Private Docker Registry with Nexus3.x.
> It built on [Nexus](https://www.sonatype.com/product-nexus-repository), and provides **GUI** environment
> I tried to write a lot of screenshots.

## Demo Environment
- Ubuntu 18.04
- Docker version 18.09.1
	- Docker requires at least > v1.8
- Nexus 3.20.1


## Install Nexus3 and create Private Docker Registry
> Nexus ip is 182.252.133.70.

> ```bash
$ ssh root@182.252.133.70
```

#### 1) Create Host <-> Nexus container permanent volume
```bash
$ mkdir /nexus-data
```
#### 2) Create Nexus container
```bash
$ docker run --name nexus -d -p 5000:5000 -p 8081:8081 -v /nexus-data:/nexus-data -u root sonatype/nexus3
```
#### 3) Connect to Nexus web http://182.252.133.70:8081
First time, login admin account is required.
admin password find `/nexus-data/admin.password`

```bash
$ cat /nexus-data/admin.password
6f471aea-1d52-4e4b-9988-1714e9bf849d # admin's password
```

![registry001.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/144058/dbf142dd-6319-e098-f427-54550a80623f.png)
![registry002.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/144058/f76dd7a2-4640-beb1-3ae0-20fcae8fcee0.png)
Enter a new admin password.
![registry003.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/144058/01147446-4844-9ce4-02a2-8ba67c04c0db.png)
![registry004.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/144058/dfc07412-4f4f-2af5-3bc6-7a4d38ce4b45.png)
![registry005.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/144058/2931aa56-e39f-04cc-4186-7fe732dcc7fb.png)

#### 4) Create `docker-hosted` and `docker-proxy` Blob on Nexus
Gear > Repository > Blob Stores > Create blob store
You need to create `docker-hosted` and `docker-hub`.
![registry008.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/144058/4027b84a-5c73-9c14-66e3-774db5828302.png)

Name : docker-hosted
![registry009.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/144058/e3901024-37a6-2078-5976-ff319e6f073d.png)

Name : docker-hub
![registry010.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/144058/4c3d4526-e2cf-fc96-6318-9a0299281831.png)

#### 5) Create `docker-hosted` and `docker-proxy` Repository on Nexus
Gear > Repository > Repositories > Create repository
You need to create `docker-hosted` and `docker-hub`.
![registry011.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/144058/526739c1-db85-6673-30dc-5481ac899b10.png)
Select `docker (hosted)`
- Name : `docker-hosted`
- Check HTTP and input 5000
- Check Enable Docker V1 API
- Select Blob store docker-hosted
![registry012.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/144058/1b80bfef-a0e3-e5e7-e84f-96cd99917467.png)
![registry013.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/144058/4027db43-01c6-9ad3-b3c9-27a76e2ae0a4.png)

Select `docker (proxy)`
- Name : `docker-hub` 
- Check Enable Docker V1 API
- Input `https://registry-1.docker.io` in Remote storage
- Select Use Docker Hub
![registry014.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/144058/a44a28ed-7409-8cb2-68ff-1fe90d8d2be1.png)
![registry015.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/144058/91c4a7bd-8426-3285-88b2-fba0c7e15ed7.png)

#### 6) Set Realms on Nexus
Gear > Realms > Move `Docker Bearer Token Realm` to active > Save
![registry017.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/144058/3128d1f1-9b93-ef1a-f793-738d7b7417b1.png)
![registry018.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/144058/79c23c48-73e0-34fd-1b57-90acd5585340.png)

#### 7) Set docker command http enabled (v1)
Create file `/etc/docker/daemon.json`
✔️ If the file does not exist, you must create it.

```bash
$ cat /etc/docker/daemon.json
```
```bash
{
        "insecure-registries" : ["182.252.133.70:5000"]
}
```

Restart docker daemon

```bash
$ service docker restart
```

Restart Nexus container

```bash
$ docker restart nexus
```

## Push image from external client to Private Docker Registry
> Client ip is 182.252.133.71.

> ```bash
$ ssh root@182.252.133.71
```

#### 1) Set docker command http enabled (v1)
Create file `/etc/docker/daemon.json` 
✔️ If the file does not exist, you must create it.
💥 All clients **must** be setting.

```bash
$ cat /etc/docker/daemon.json
```
```bash
{
        "insecure-registries" : ["182.252.133.70:5000"]
}
```

Restart docker daemon

```bash
$ service docker restart
```

#### 2) Login Private Docker Registry

```bash
$ docker login 182.252.133.70:5000
```
```bash
Username: admin
Password:
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded
```

#### 3) docker pull and push Private Docker Registry
docker pull busybox image (from [https://hub.docker.com/_/busybox](https://hub.docker.com/_/busybox))

```bash
$ docker pull busybox # docker pull from hub.docker.com 
bdbbaa22dec6: Pull complete
Digest: sha256:6915be4043561d64e0ab0f8f098dc2ac48e077fe23f488ac24b665166898115a
Status: Downloaded newer image for busybox:latest
docker.io/library/busybox:latest
```
Check busybox image

```bash
$ docker images -a
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
busybox             latest              6d5fcfe5ff17        5 weeks ago         1.22MB
```
tag

```bash
$ docker tag 6d5fcfe5ff17 182.252.133.70:5000/busybox:v20200205
```
push Private Docker Registry

```bash
$ docker push 182.252.133.70:5000/busybox:v20200205
The push refers to repository [182.252.133.70:5000/busybox]
195be5f8be1d: Pushed
v20200205: digest: sha256:edafc0a0fb057813850d1ba44014914ca02d671ae247107ca70c94db686e7de6 size: 527
```

## Check image in Private Docker Registry
#### 1) Connect to Nexus web http://182.252.133.70:8081
Browse > docker-hosted
![registry020.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/144058/ae1c7ca0-9636-f579-b6ea-dc779fc82c04.png)

tag 
![registry021.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/144058/55163ea7-b05c-3fb7-1cc8-9f9db4bf2ed8.png)

## Pull in Private Docker Registry

```bash
$ docker pull 182.252.133.70:5000/busybox:v20200205
bdbbaa22dec6: Pull complete
Digest: sha256:edafc0a0fb057813850d1ba44014914ca02d671ae247107ca70c94db686e7de6
Status: Downloaded newer image for 182.252.133.70:5000/busybox:v20200205
182.252.133.70:5000/busybox:v20200205
```
```bash
$ docker images -a
REPOSITORY                    TAG                 IMAGE ID            CREATED             SIZE
182.252.133.70:5000/busybox   v20200205           6d5fcfe5ff17        5 weeks ago         1.22MB
```

## More to do
> 443 port, need adding SSL

SSL should be applied. 
After that, creating file `/etc/docker/daemon.json` can be omiited.
💡 I'll write this next posting.