DIY Private Container Registry
Márk Sági-Kazár
2023-09-21 @ Open Source Summit EU 2023
Let me tell you a story…
Requirements
- Share container images with design partners
- Target environments
- developer machine
- CI
- container orchestrator
- → Flexible authentication and authorization
- Minimize operational burden (monitoring, backup, etc)
Available solutions
Cloud-hosted
P2P
All-in-one solutions
Plain old registries
Cloud-hosted registries
- Pros
- Easy to set up
- No operational burden
- Cons
- Requires cloud provider account
- Manual IAM setup
New requirements
- No cloud provider registration required
- Flexible authorization (eg. entitlement-based)
Back to research
Cloud-hosted
Plain old registries
All-in-one solutions
Quay (wasn’t open source at the time)
Portus (unmaintained)
Harbor
- Structures artifacts into projects
- Robot accounts for service-to-service auth
- Simple authorization
- Image replication
- Uses Distribution as a registry
![]()
Harbor quirks and cons
- Group based access for users, but not for robot accounts
- Cross-project robot account creation requires admin access
- API integration only works with the admin credentials
- Complex software for a specific use case
- Operation is not trivial
New requirements
- Self-serve portal
- Closer integration with sales and licensing systems
Maybe it’s time to build our own solution.
Let’s put it all together
Distribution
- Reference Docker registry implementation
- Major providers rely on it
https://github.com/distribution/distribution
![]()
Zot
A production-ready vendor-neutral OCI-native container image registry (purely based on OCI Distribution Specification)
- Registry auth is currently broken
https://zotregistry.io
![]()
Registry auth caveats
- Not a formal specification
- There are several gaps in it
- Competing, but incompatible specs (eg. ChartMuseum Auth)
- Partial implementations
