拉取 Artifactory Docker 镜像

Question

I downloaded artifactory 6.6.0 on remote desktop with ip (xxxx) and connect to port 8081.

I can connect to artifactory from my computer http://xxxx:8081/artifactory . I have docker client on my computer but I don't have docker on remote desktop.

I have virtual docker repository named "docker".

I want to login by docker client to my docker repository on artifactory -> "docker login " and then pull images in this repository.

How can I log in and pull images from artifactory? Notice I don't have SSL so I'm using HTTP.

Answer 1

First: docker login related to Artifactory -> Configurations -> HTTP Settings I used "Docker access method" as "Repository path"

docker login -u admin -p **** xxxx:8081

Second: Since i use HTTP, this ip "xxxx:8081" should be added to "insecure-registries" in Docker client.

or just add it to insecure registries in ~/.docker/config.json like below:

   {
    "auths": {
        "x.x.x.x:8081": {}
    },
    "HttpHeaders": {
        "User-Agent": "Docker-Client/18.09.0 (windows)"
    },
    "credsStore": "wincred"
}

and then restart docker

Answer 2

I don't know how it works when accessing the server with just an IP address... but if you use a hostname, you need to prefix it with the name of the repo.

Example:

My Artifactory Enterprise server is at https://artifactory.mycompany.com

I can pull images with

docker login repo1.artifactory.mycompany.com
docker pull repo1.artifactory.mycompany.com/myImage:latest

Dockerfile example:

FROM repo1.artifactory.mycompany.com/myImage:latest

(You will need to run docker login repo1.artifactory.mycompany.com before running docker build .)

Answer 3

There are different ways in which Docker can be configured to work with on the Artifactory side, these are:

1. Repo Path Method
2. Subdomain Method
3. Port Method

Repo path is the method which this question is using, and for which we request the image by its full path eg

docker pull / push <HOST>:8081/<REPOSITORY_KEY>/<IMAGE>:<TAG>
docker login <HOST>:8081

What is worth noting is that in order for this to work, we need to go to the HTTP Settings of Artifactory and set the Docker method to be "Repository Path" as otherwise certain Tomcat-level re-writes are not enabled and your login may not work.

Subdomain replaces the repository name from being in the path to being in the subdomain as someone mentioned before was the case for them, eg

docker pull / push <REPOSITORY_KEY>.<HOSTNAME>/<IMAGE>:<TAG>
docker login <REPOSITORY_KEY>.<HOSTNAME>

Port method is similar to the other two, but instead of removing the repository from the path to declare and prepending it to the hostname, we will use different ports to differentiate between repos eg

docker pull / push <HOST>:<REPOSITORY_PORT>/<IMAGE>:<TAG>
docker login <HOST>:<REPOSITORY_PORT>

The repository port would be defined in the re-writes at reverse proxy level, just the same as for the subdomain method.

The issue the question talks about is likely the insecure registry that was mentioned before, as docker needs to use HTTPS unless explicitely allowed to not do so.

For repository path method, if using SSL, make sure to use a wildcard certificate *.myhostname.com so that the different repositories can be connected to securely and not complain about the hostname not matching with the cert.

Clarification on some wording:

Docker Image: What would be referred to as the group "namespace/repository:tag" in Docker terms. For example in docker pull docker-repo.myhostname.com/mycompany/ourapp:latest the image name would be mycompany/ourapp:latest

Repository: In Docker repository is what most people recognize as the image name, or in above example "ourapp". What I refer to as repository most of the time, is what most people would call a registry. The terminology gets confusing as Artifactory can hold many of these registries, and for most other technologies the naming convention tends to be to call them "repositories" at that level. When talking about Artifactory and someone says "repository" it most likely refers to the registry as a whole.