{"action":"created","issue":{"url":"https://api.github.com/repos/docker/docker-registry/issues/541","labels_url":"https://api.github.com/repos/docker/docker-registry/issues/541/labels{/name}","comments_url":"https://api.github.com/repos/docker/docker-registry/issues/541/comments","events_url":"https://api.github.com/repos/docker/docker-registry/issues/541/events","html_url":"https://github.com/docker/docker-registry/issues/541","id":41391785,"number":541,"title":"Authentication on private registry","user":{"login":"matleh","id":84861,"avatar_url":"https://avatars.githubusercontent.com/u/84861?v=3","gravatar_id":"","url":"https://api.github.com/users/matleh","html_url":"https://github.com/matleh","followers_url":"https://api.github.com/users/matleh/followers","following_url":"https://api.github.com/users/matleh/following{/other_user}","gists_url":"https://api.github.com/users/matleh/gists{/gist_id}","starred_url":"https://api.github.com/users/matleh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/matleh/subscriptions","organizations_url":"https://api.github.com/users/matleh/orgs","repos_url":"https://api.github.com/users/matleh/repos","events_url":"https://api.github.com/users/matleh/events{/privacy}","received_events_url":"https://api.github.com/users/matleh/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/docker/docker-registry/labels/documentation","name":"documentation","color":"5319e7"},{"url":"https://api.github.com/repos/docker/docker-registry/labels/hardening","name":"hardening","color":"0052cc"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/docker/docker-registry/milestones/7","labels_url":"https://api.github.com/repos/docker/docker-registry/milestones/7/labels","id":739530,"number":7,"title":"1.0","description":"Last release for the v1 docker registry.\r\nWill be maintenance only, focusing on cleanup, bugfixing, and documentation enhancements.","creator":{"login":"dmp42","id":332946,"avatar_url":"https://avatars.githubusercontent.com/u/332946?v=3","gravatar_id":"","url":"https://api.github.com/users/dmp42","html_url":"https://github.com/dmp42","followers_url":"https://api.github.com/users/dmp42/followers","following_url":"https://api.github.com/users/dmp42/following{/other_user}","gists_url":"https://api.github.com/users/dmp42/gists{/gist_id}","starred_url":"https://api.github.com/users/dmp42/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dmp42/subscriptions","organizations_url":"https://api.github.com/users/dmp42/orgs","repos_url":"https://api.github.com/users/dmp42/repos","events_url":"https://api.github.com/users/dmp42/events{/privacy}","received_events_url":"https://api.github.com/users/dmp42/received_events","type":"User","site_admin":false},"open_issues":19,"closed_issues":35,"state":"open","created_at":"2014-08-01T09:59:48Z","updated_at":"2015-01-07T19:12:10Z","due_on":"2015-01-01T08:00:00Z","closed_at":null},"comments":33,"created_at":"2014-08-28T13:50:34Z","updated_at":"2015-01-19T21:54:14Z","closed_at":null,"body":"I am implementing a private docker-index, taking some guidance from http://docs.docker.com/reference/api/hub_registry_spec/. It seems to me that this documentation is not in line with the current implementation of the docker-registry (not sure about docker itself).\r\n\r\nThe docs talk about a cookie being used for communication between docker and docker-registry. Since docker-registry 0.7 cookies are no longer used (so says the changelog).\r\n\r\nIt looks like docker just reuses the token from the docker-index for each call it has to make to the registry during a \"pull\" or \"push\". But that means, docker has to use a token with \"access=write\" to GET different resources before it PUTs the image data. The registry sends a 401 for any GET request which is made using a token with \"access=write\". The \"push\" still seems to work, but I am not sure about the consequences of these 401 (and some 409) responses.\r\n\r\nMaybe I misunderstand something about the interaction between docker, registry and index?\r\n\r\nA possible workaround could be to have the registry accept \"access=write\" tokens for GET requests (or to generalize: \"read\" is only valid for GET, \"write\" is valid for GET, PUT and POST and \"delete\" is valid for GET, PUT, POST and DELETE).\r\n\r\nStill the question remains at what time the index can invalidate a token. The docs say that a token is invalidated when the registry uses it to check the access rights. But since the registry has to use the same token a couple of times it seems like we can currently only assign a static TTL to all tokens and invalidate them after that timespan.\r\n\r\n@samalba, I was told that you are the go-to-authority for everything related to the registry: what do you think?"},"comment":{"url":"https://api.github.com/repos/docker/docker-registry/issues/comments/70568064","html_url":"https://github.com/docker/docker-registry/issues/541#issuecomment-70568064","issue_url":"https://api.github.com/repos/docker/docker-registry/issues/541","id":70568064,"user":{"login":"paturuv","id":5647015,"avatar_url":"https://avatars.githubusercontent.com/u/5647015?v=3","gravatar_id":"","url":"https://api.github.com/users/paturuv","html_url":"https://github.com/paturuv","followers_url":"https://api.github.com/users/paturuv/followers","following_url":"https://api.github.com/users/paturuv/following{/other_user}","gists_url":"https://api.github.com/users/paturuv/gists{/gist_id}","starred_url":"https://api.github.com/users/paturuv/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/paturuv/subscriptions","organizations_url":"https://api.github.com/users/paturuv/orgs","repos_url":"https://api.github.com/users/paturuv/repos","events_url":"https://api.github.com/users/paturuv/events{/privacy}","received_events_url":"https://api.github.com/users/paturuv/received_events","type":"User","site_admin":false},"created_at":"2015-01-19T21:54:14Z","updated_at":"2015-01-19T21:54:14Z","body":"The basic authentication on docker private registry using nginx is real tricky one. \r\nNot sure if that really works with docker client.\r\n\r\nI have docker registry running on a ssl enabled server. I am using nginx to enable ssl and configured the basic authentication too.\r\n\r\nThe curl works find to connect to registry and get response. Where as the docker client can't go through with the following error message :\r\n            Error response from daemon: Server Error: Post https://example.domain.com/v1/users/: \r\n            x509: certificate signed by unknown authority \r\n\r\nI have figured out that the docker won't work with self signed certificates and hence created a CA certificate and used the same, still the same issue.\r\n\r\nAm I missing anything here or is it a bug?"}}