How to Push and Pull Docker Images Using DigitalOcean's Container Registry

insert image description here
DigitalOcean's Container Registry gives you a private space in the cloud to store and distribute your Docker images. In addition to providing image repositories, the service integrates into other DigitalOcean services. You can deploy stored images to App Platform and use them with managed Kubernetes clusters.

Advantages and Features

Container Registry is a Docker Hub competitor that lets you save Docker images in your DigitalOcean account. This is ideal when you will use other DigitalOcean features to access these images. You don't need to set up a separate paid Docker Hub account for your app's private images.

Data held in Container Registry is automatically load-balanced across multiple DigitalOcean data center regions. This speeds up image retrieval when you start containers and pull them to your machine. Unlike other DigitalOcean features, you cannot manually select data centers for Container Registry.

DigitalOcean's registry implementation is OCI compliant, so you can interact with it using familiar ecosystem tools. Once the registry's credentials are added to the CLI, commands like docker push "just work". docker pull Similarly, orchestrators such as Kubernetes will have no problem referencing images in your registry.

Create a registry

Container Registry is available for free, but the free plan does have some serious limitations. You get an image repository (top-level image name), 500MB storage, and a 500MB outbound data transfer cap—enough to evaluate the service, but probably not for long-term use. The $5/month basic plan gives you five repositories and 5GB, while the $20/pro version gives you unlimited repositories and 100GB of storage. Storage overage is billed at $0.02/GB.
insert image description here
Create a registry by logging into the DigitalOcean Control Panel and clicking the "Container Registry" link in the left column. Name your new registry and choose your storage plan. This name must be globally unique within each DigitalOcean registry, so your preference may not be available. It needs to contain up to 63 characters, including letters, numbers, and hyphens.

Creating a new registry may take a few seconds. Once the process is complete, you will be taken to the registry's dashboard screen.

Connect your Docker CLI

The next step is to connect the Docker CLI to the registry. You need to provide Docker with your registry credentials so it can push and pull images using your account. There are three different ways to achieve this.

Using Doctl

DigitalOcean's official command line utility, Doctl, includes a convenience script to configure your Docker client to work with your Container Registry.

You need Doctl installed and authenticated with your DigitalOcean account to use this method. Run the following command to set up the integration:

doctl registry login

Using DigitalOcean API Tokens

DigitalOcean API tokens can be used to authenticate to Container Registries. Generate a token by clicking the "API" link at the bottom of the left sidebar of your DigitalOcean account. Click "Generate New Token", give it a name, and press "Generate Token" in the following popup.
insert image description here
The token value will be displayed. Make a note of this as you won't be able to retrieve it later. Now go back to your CLI and use the docker login command to connect to your registry:

docker login registry.digitalocean.com

You will be prompted for a username and password. Use the value of the API token you generated for both fields. Docker will now be able to interact with the DigitalOcean registry that belongs to your account.

Download the Docker credentials file

If you don't want to generate an API key or use Doctl, go to the Container Registry Dashboard page and click the blue "Actions" button in the upper right corner. Select Download Docker Credentials from the menu.
insert image description here
This file is a Docker compatible config.json that contains credentials for the registry. You can merge this with the main ~/.docker/config.json file or use the --config flag with the docker command:

docker --config ~/downloaded-config.json pull registry.digitalocean.com/<your-registry-name>/example-image:latest

Push and pull images with Docker

Once Docker is properly configured, you can now use the CLI to push and pull images from the Container Registry. Images must be tagged in the following format:

registry.digitalocean.com/<your-registry-name>/example-image:latest

Here's a simple example that pushes a copy of an existing image to the registry:

docker pull httpd:latest
docker tag httpd:latest registry.digitalocean.com/<your-registry-name>/httpd:latest
docker push registry.digitalocean.com/<your-registry-name>/httpd:latest

insert image description here
Go to the Registry Dashboard in the DigitalOcean Control Panel. Your newly pushed image should show up in your registry. You can click on the image to see the available tags. Remove a specific tag or all tags available to an image by clicking the three dots icon on the far right and choosing from the menu.

garbage collection

Deleting images from the registry may leave redundant layers that are no longer used by any remaining manifests. These tiers will still count towards your storage costs.

DigitalOcean provides a garbage collection tool to remove orphaned layers and manifests. You'll see a tile on the registry's dashboard screen when garbage collection can free up storage space. Click "Empty Trash" to start the process. insert image description here
You'll see a pop-up dialog that lets you choose whether to delete untagged manifests during the cleanup process. These are valid images with no assigned tags, so they can only be referenced by their full ID, eg registry.digitalocean.com//example-image:a1bc23. Unless you intentionally keep them, these listings usually need to be removed. insert image description here
Garbage collection puts your registry in a read-only state until all unused layers are removed. New pushes will be rejected during cleanup. Collection does not start until existing writes are complete, so there may be a slight delay after you start the process. The progress is displayed on the dashboard page of the registry in the control panel.

DigitalOcean does not provide automatic garbage collection. However, the process can be run using Doctl and the DigitalOcean API, so you can write your own scripts and use cron.

in conclusion

DigitalOcean's Container Registry provides you with a convenient way to store Docker images. You use your existing DigitalOcean API token to authenticate to the registry. You should remember that API tokens have full access to your account - they are not limited to registry access.

Whether you should use Container Registry to support Docker Hub depends on how you're going to handle your images. If you're deploying them to DigitalOcean, it makes sense to put the images together with the infrastructure to maximize performance. However, Docker Hub also has benefits in other areas, such as automated image rebuilds and vulnerability scans that can quickly flag security issues. DigitalOcean's service doesn't have that, instead focusing on pure and simple image storage.

Guess you like

Origin blog.csdn.net/wlcs_6305/article/details/123409559