docker-registry Use SSH pub key in order to allow access to a repository

Hello,

As I'm looking to mount a private Docker registry server, I'd like to limit the access not with user/password authentication system but with SSH key like Git does today.

Is there any plan to do this or am I the first one to request this ? :smile:

Aug 20 '14 15:08 zedtux

What I mean is to be able to do then:

docker push [email protected]:zedtux/my-docker-image

This would then push to my private server as I would have imported my SSH key in the docker registry (updating then the .ssh/authorised file).

Aug 20 '14 17:08 zedtux

@zedtux so, you suggestion would mean using ssh as a transport (instead of http) - which is an idea. Though, this is largely irrelevant to this project (docker-registry) and something you should rather suggest on the main docker repo / discussions.

Aug 20 '14 22:08 dmp42

@dmp42 yes that is exactly the idea, to add another transport protocol to docker.

I have opened the ticket in this repo as I guess this repo will need to implement the SSH key management, isn't it ?

Anyway, I'm going to open another issue on the docker project itself mentioning this issue. Thank you in any cases.

Aug 20 '14 22:08 zedtux

Done: docker issue #7650

Aug 20 '14 22:08 zedtux

I guess I have just faced with a need of the same feature. +1.

Feb 20 '15 09:02 vitalyisaev2

:+1: Here's what I've done in the mean time...

# Server 1: Registry Server
docker run -d -p 127.0.0.1:5000:5000 registry:2

# Server 2: SSH Auth Server
ssh -f -N -L 5000:localhost:5000 user@registry_server_address -g

# Client: Test, should fail
curl http://registry_server_address:5000/v2/_catalog

# Client: Test, should pass
curl http://ssh_auth_server_address:5000/v2/_catalog

And now only those with SSH pub keys on Server 2 have access to the registry. Make sure to add --insecure-registry ssh_auth_server:5000 to your client's Docker daemon command.