Private docker registry behind subpath reddit / selfhosted ---------------------------------------------------------------------- NobodyRulesPenguins 路 2023-09-29 16:39 Hello, Maybe some of you have the same setup and know how to fix my issue. I've just setup a private docker registry at home. Accessing it locally on the port 5000 work great once declared insecure. From outside it is set behind a subdomain name behind a subpath with https. All that manager by haproxy. Globally: * https://services.example.com/registry/ https://services.example.com/registry/v2/ seem to work normally. https://services.example.com/registry/v2/_catalog give me the list of the images I have put from localhost:5000 (mainly hello-world for testing) But docker/podman pull only give me 404 errors at best. I have tried setting REGISTRY_HTTP_PREFIX and nothing special on the reverse proxy side. That worked the same way. Removing the env var and adapting the reverse proxy work well too (current configuration) Finally I have set REGISTRY_HTTP_ADDR to https://services.example.com/registry/ without any change in the system working. The only thing I didnt do was setting any form of authentication yet and I wonder if this is why I only get 404 (yay a free pull/push registry online \o/) But lot of registries work without login, so I dont see it as a point of failure. Any idea what I have missed that is requiered ? Is it ok and just my podman configuration that need to be adapted because of the subpath? Do I need more specific configuration ? Thanks in advance for you help! *Note*: if needed or fixed and somebody is interested I will add the compose and other needed configuration files later today once back home ---------------------------------------------------------------------- ElevenNotes 路 2023-09-29 17:36 Remove /registry via rewrite in your reverse proxy should do the trick. ---------------------------------------------------------------------- NobodyRulesPenguins 路 2023-09-29 17:38 That is the current configuration, but no luck with it 馃槙 ---------------------------------------------------------------------- ElevenNotes 路 2023-09-29 17:39 Show us your reverse proxy config. ---------------------------------------------------------------------- NobodyRulesPenguins 路 2023-09-29 17:45 Done in the main topic, sorry for the limited content, copy/paste from the phone via ssh isn't great. ---------------------------------------------------------------------- ElevenNotes 路 2023-09-29 17:48 Must say I have never used haproxy for HTTP so I'm not sure what to make of it. If you access the registry without the proxy and with, check the logs of it if the URL is the same. ---------------------------------------------------------------------- NobodyRulesPenguins 路 2023-09-29 18:01 This configuration mainly remove /registery from the url before passing it the the service (just a regex really). I use the same for a few other services so I am sure it is working well. I can access v2/ and v2/_catalog and see the registry listing. So it is working from outside too, my guess is that I miss something on the client side because of the subpath 馃槙 Not sure about other url to try, I dont know much about how a registry work. I only put docker hello-world on it (from localhost) for testing ---------------------------------------------------------------------- ElevenNotes 路 2023-09-29 18:03 Ah shit I forgot about the clients. Yeah. Just drop the /registry and use an FQDN docker.domain.com. ---------------------------------------------------------------------- NobodyRulesPenguins 路 2023-09-29 18:16 That is what I had hope to have to do since the registry itself allow for subpath configuration 馃檨 I will try a little more, browse the client configuration or even ask on their github. If they tell me there is no way with the current version I will go for the subdomain instead ---------------------------------------------------------------------- ElevenNotes 路 2023-09-29 18:17 Why not subdomain in the first place? ---------------------------------------------------------------------- NobodyRulesPenguins 路 2023-09-29 18:29 All of my current services are behind: https://services.example.com/ I have a /dav /webdav /bookstack /gitea /monica /vikunja in progress, /kanboard /vaultwarden, /code-server, etc ... I wanted to keep the same schema for everything if possible. In the end it is just a preference between subdomain and subpath. The only difference is that application that are not path agnostic are a pain, or sometime just impossible to set. And that I do not have any need to add a new DNS line each time I want to try another thing ---------------------------------------------------------------------- NobodyRulesPenguins 路 2023-09-29 18:40 All of my current services are behind: https://services.example.com/ I have a /dav /webdav /bookstack /gitea /monica /vikunja in progress, /kanboard /vaultwarden, /code-server, etc ... I wanted to keep the same schema for everything if possible. In the end it is just a preference between subdomain and subpath. The only difference is that application that are not path agnostic are a pain, or sometime just impossible to set. And that I do not have any need to add a new DNS line each time I want to try another thing ---------------------------------------------------------------------- NobodyRulesPenguins 路 2023-09-29 18:52 I may have a chance [with podman](https://github.com/containers/image/blob/main/docs/containers- registries.conf.5.md), the location (or prefix) option seem to match that use case. If podman have it there is probably similar thing on the docker side. I will be able to try in a few hours once home ---------------------------------------------------------------------- NobodyRulesPenguins 路 2023-09-30 10:22 In the end the subdomain won, the registry itself handle well wherever it is, but the client refuse to change 馃槙 At least I tried, maybe that will become an evolution in the futur. Thanks for your help! ---------------------------------------------------------------------- ElevenNotes 路 2023-09-30 10:23 Subdomain ftw ---------------------------------------------------------------------- NobodyRulesPenguins 路 2023-09-30 10:32 Theses are nice I cannot deny that, but I liked my every services behind only one. I guess there will be exceptions sometime ---------------------------------------------------------------------- ElevenNotes 路 2023-09-30 10:48 Adapt. I'm the "with the head through the wall" guy all the time, but with subdomains for everything I never had an issue with any service and I host multiple docker registries. ---------------------------------------------------------------------- NobodyRulesPenguins 路 2023-09-30 11:18 Thanks! I do, it's just that I prefered it the subpath way, looked cleaner for me, not that the switch take time (it took me 3:30 to add the DNS entry, modify the compose, haproxy, reload everything and test), but I miss the old days when website/webservices where mostly made with relative path and worked from anywhere and absolute path where a bad design, it seem everything switched around with no real reason from then. Even mounting that registry was just for a subpath reason, I've been fighting for 3 day to make Vikunja work from one, but the building fail in Podman with no obvious reason... So I planned to use my work laptop which have Docker, build it with it if that work, push it to the registry then continue as usual with Podman. I cannot deny that I love to overcomplicate with my choices, but at least that make the learning experience fun! ---------------------------------------------------------------------- ElevenNotes 路 2023-09-30 11:45 podman > docker.