Docker Private Registry：ping尝试失败

Question

I'm trying to set up my private Docker Registry and I'm following the official documentation . I have installed Docker and I'm able to run my registry on my server. But I want my registry to be more widely available. My docker-server with the private registry is installed on an AWS-instance. I have created my own certificate and key by using keytool:

docker run -d -p 5000:5000 --restart=always --name registry \
  -v `pwd`/certs:/certs \
  -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt \
  -e REGISTRY_HTTP_TLS_KEY=/certs/domain.key \
  registry:2

I'm able to ping this instance by:

ping ec2-xx-xx-xx-xx.xx-west/east-1.compute.amazonaws.com

But pushing is not possible:

The push refers to a repository [ec2-xx-xx-xx-xx.compute.amazonaws.com:5000/ubuntu] (len: 1)
unable to ping registry endpoint https://ec2-xx-xx-xx-xx.compute.amazonaws.com:5000/v0/
v2 ping attempt failed with error: Get https://ec2-xx-xx-xx-xx.compute.amazonaws.com:5000/v2/: dial tcp 10.x.x.x:5000: i/o timeout
 v1 ping attempt failed with error: Get https://ec2-xx-xx-xx-xx.amazonaws.com:5000/v1/_ping: dial tcp 10.0.x.x:5000: i/o timeout

EDIT1: After changing my aws-security group. Set port 5000 to TCP , the error changed:

unable to ping registry endpoint https://ec2-xx-xx-xx-xx.compute.amazonaws.com:5000/v0/
v2 ping attempt failed with error: Get https://ec2-xx-xx-xx-xx.compute.amazonaws.com:5000/v2/: dial tcp 10.0.x.x:5000: connection refused
 v1 ping attempt failed with error: Get https://ec2-xx-xx-xx-xx.compute.amazonaws.com:5000/v1/_ping: dial tcp 10.0.x.x:5000: connection refused

How do I have to make my registry accessible for other aws-instances? My docker logs are showing the following. They can't find my certificate.

level=fatal msg="open /certs/domain.crt: no such file or directory" 

Do I have to put this certificate in my container itself? (and generate it with keytool by myself or using an existing)

EDIT2: I've generated my own certificates using this documentation . After generating the certificates I did restart my docker daemon. I did not perform the copy of domain.crt to ca.crt because the path didn't exist. Maybe I have to create it by myself?

new error:

unable to ping registry endpoint https://ec2-xx-xx-xx-xx.compute.amazonaws.com:5000/v0/
v2 ping attempt failed with error: Get https://ec2-xx-xx-xx-xx.compute.amazonaws.com:5000/v2/: dial tcp 10.0.x.x:5000: no route to host
 v1 ping attempt failed with error: Get https://ec2-xx-xx-xx-xx.compute.amazonaws.com:5000/v1/_ping: dial tcp 10.0.x.x:5000: no route to host

But I still get the following in my docker logs:

level=fatal msg="open /certs/domain.crt: no such file or directory" 

After trying to perform a push, there is created a new /certs folder into my existing certsfolder

EDIT3: After finding the right directory for my certificate (/home/centos/certs/certs/*.). I get the following error:

level=fatal msg="open /certs/domain.crt: permission denied

Even if I perform a chmod -R 777 and chown -R root:root

Answer 1

您需要将证书放在此目录中。

    /etc/docker/certs.d/<your-domain-name>:5000/ca.crt