Small Docker v2 registry auth server in Go.

It exists mostly as a project to learn Go, the Vagrant Docker provider, and to understand the protocol Portus implements.

• Authentication is only supported using htpasswd files
• Once authenticated, it provides push and pull access to the /$user namespace

Garita is inspired in Portus, which is a full featured auth server and registry index.

Garita uses HTTPS by default. If you want to run over plain http (eg. for development purposes) you need to pass the option -http. Then you don't need to supply --tlscert and --tlskey options.

garita --key path/to/server.key --htpasswd path/to/htpasswd --tlskey path/to/server.key --tlscert path/to/server.crt

You can pass a configuration file in toml format with -c or --config. Any other configuration from the command line overrides the configuration file.

At the same time you need to configure the registry

auth:
  token:
    realm: https://garita.yourdomain.com/v2/token
    service: registry.yourdomain.com
    issuer: garita.yourdomain.com
    rootcertbundle: /path/to/server.crt

If you use a self signed certificate, add the CA certificate to the system trusted anchors on the docker daemon host or add the certificate to:

/etc/docker/certs.d/<garita host>/ca.crt

The environment creates 3 containers:

• a Docker daemon (dockerd, dockerd.test.lan)
• a Registry (registry, registry.test.lan)
• garita (garita, garita.test.lan)

While the images are based on opensuse:13.2, the dockerd container requires a host kernel with overlayfs support. (eg. openSUSE Tumbleweed or another distribution supporting overlayfs). The dockerd container is already privileged but I don't want to mess with the loop devices of the host.

• Compile

go install github.com/dmacvicar/garita

• Start the environment

vagrant up --no-parallel

• Everytime you rebuild

vagrant reload garita

• To see the logs

vagrant docker-logs -f garita

Run docker against the docker daemon running inside the container

docker -H tcp://localhost:23750 images

The typical testcase, pull busybox, tag it, and push it to the registry

docker -H tcp://localhost:23750 pull busybox
docker -H tcp://localhost:23750 tag busybox registry.test.lan/duncan/busybox
docker login registry.test.lan
docker -H tcp://localhost:23750 push registry.test.lan/duncan/busybox

The specification does not go into every detail. If I missed something please open an issue.

• Duncan-Mac-Vicar P. dmacvicar@suse.de

• Garita is licensed under the Apache 2.0 license.