### Configuring nodes to authenticate to a private registry <del> If you run Docker on your nodes, you can configure the Docker container runtime to authenticate to a private container registry. </del> <ins> Specific instructions for setting credentials depends on the container runtime and registry you chose to use. You should refer to your solution's documentation for the most accurate information. </ins> <del> This approach is suitable if you can control node configuration. {{< note >}} Default Kubernetes only supports the `auths` and `HttpHeaders` section in Docker configuration. Docker credential helpers (`credHelpers` or `credsStore`) are not supported. {{< /note >}} Docker stores keys for private registries in the `$HOME/.dockercfg` or `$HOME/.docker/config.json` file.  If you put the same file in the search paths list below, kubelet uses it as the credential provider when pulling images. * `{--root-dir:-/var/lib/kubelet}/config.json` * `{cwd of kubelet}/config.json` * `${HOME}/.docker/config.json` * `/.docker/config.json` * `{--root-dir:-/var/lib/kubelet}/.dockercfg` * `{cwd of kubelet}/.dockercfg` * `${HOME}/.dockercfg` * `/.dockercfg` {{< note >}} You may have to set `HOME=/root` explicitly in the environment of the kubelet process. {{< /note >}} Here are the recommended steps to configuring your nodes to use a private registry.  In this example, run these on your desktop/laptop: 1. Run `docker login [server]` for each set of credentials you want to use.  This updates `$HOME/.docker/config.json` on your PC. 1. View `$HOME/.docker/config.json` in an editor to ensure it contains only the credentials you want to use. 1. Get a list of your nodes; for example: - if you want the names: `nodes=$( kubectl get nodes -o jsonpath='{range.items[*].metadata}{.name} {end}' )` - if you want to get the IP addresses: `nodes=$( kubectl get nodes -o jsonpath='{range .items[*].status.addresses[?(@.type=="ExternalIP")]}{.address} {end}' )` 1. Copy your local `.docker/config.json` to one of the search paths list above. - for example, to test this out: `for n in $nodes; do scp ~/.docker/config.json root@"$n":/var/lib/kubelet/config.json; done` {{< note >}} For production clusters, use a configuration management tool so that you can apply this setting to all the nodes where you need it. {{< /note >}} Verify by creating a Pod that uses a private image; for example: ```shell kubectl apply -f - <<EOF apiVersion: v1 kind: Pod metadata: name: private-image-test-1 spec: containers: - name: uses-private-image image: $PRIVATE_IMAGE_NAME imagePullPolicy: Always command: [ "echo", "SUCCESS" ] EOF ``` ``` pod/private-image-test-1 created ``` If everything is working, then, after a few moments, you can run: ```shell kubectl logs private-image-test-1 ``` and see that the command outputs: ``` SUCCESS ``` If you suspect that the command failed, you can run: ```shell kubectl describe pods/private-image-test-1 | grep 'Failed' ``` In case of failure, the output is similar to: ``` Fri, 26 Jun 2015 15:36:13 -0700    Fri, 26 Jun 2015 15:39:13 -0700    19    {kubelet node-i2hq}    spec.containers{uses-private-image}    failed        Failed to pull image "user/privaterepo:v1": Error: image user/privaterepo:v1 not found ``` You must ensure all nodes in the cluster have the same `.docker/config.json`.  Otherwise, pods will run on some nodes and fail to run on others.  For example, if you use node autoscaling, then each instance template needs to include the `.docker/config.json` or mount a drive that contains it. All pods will have read access to images in any private registry once private registry keys are added to the `.docker/config.json`. </del> <ins> For an example of configuring a private container image registry, see the [Pull an Image from a Private Registry](/docs/tasks/configure-pod-container/pull-image-private-registry) task. That example uses a private registry in Docker Hub. </ins> ### Interpretation of config.json {#config-json}