Setting up private registry in Docker - Practice Exercises

Challenge - 5 Problems

💻 Command Output

intermediate

Docker command to start a private registry

What is the output of the command when you start a Docker private registry with the following command?

docker run -d -p 5000:5000 --name registry registry:2

Assume Docker is installed and the command runs successfully.

Docker

docker run -d -p 5000:5000 --name registry registry:2

A A container ID string is printed, indicating the registry container started in detached mode.

B Error: image 'registry:2' not found locally and no pull access.

C The command outputs 'Registry started on port 5000'.

D The command outputs 'Permission denied' due to port binding.

💡 Hint

Detached mode (-d) returns the container ID if successful.

Running the registry container in detached mode returns the container ID. It does not print a message like 'Registry started'. If the image is missing, Docker pulls it automatically unless there's no access.

❓ Configuration

intermediate

Configuring Docker daemon to trust insecure registry

You want Docker on your client machine to trust a private registry running on localhost:5000 without TLS. Which configuration snippet should you add to /etc/docker/daemon.json to allow this?

A

{
  "registry-mirrors": ["http://localhost:5000"]
}

B

{
  "trusted-registries": ["localhost:5000"]
}

C

{
  "allow-insecure": true
}

D

{
  "insecure-registries": ["localhost:5000"]
}

💡 Hint

Docker uses 'insecure-registries' key for this purpose.

The Docker daemon configuration uses the 'insecure-registries' key to list registries that do not use TLS. Other keys like 'trusted-registries' or 'allow-insecure' do not exist.

🔀 Workflow

advanced

Steps to push an image to a private registry

Which sequence of commands correctly pushes a local Docker image named myapp:latest to a private registry running on localhost:5000?

A 4,3,1,2

B 4,1,3,2

C 1,4,3,2

D 3,4,1,2

💡 Hint

You must build the image first, then login, tag, and push.

First build the image locally, then login to the private registry, tag the image with the registry address, and finally push it.

❓ Troubleshoot

advanced

Diagnosing Docker push failure to private registry

You try to push an image to your private registry at localhost:5000 but get the error:

denied: requested access to the resource is denied

What is the most likely cause?

A You forgot to login to the private registry before pushing.

B Docker daemon is not configured to allow insecure registries.

C The image name is missing the registry prefix.

D The private registry container is not running.

💡 Hint

Check if the image name includes the registry address.

The error usually means Docker is trying to push to Docker Hub instead of your private registry because the image name lacks the registry prefix like 'localhost:5000/'.

✅ Best Practice

expert

Securing a private Docker registry with TLS

Which of the following is the best practice to secure a private Docker registry running on your server?

A Run the registry without TLS and configure clients to use insecure registries.

B Run the registry behind a reverse proxy that handles TLS termination with valid certificates.

C Run the registry with self-signed TLS certificates and configure clients to trust them.

D Use HTTP only and restrict access by IP firewall rules.

💡 Hint

Using a reverse proxy with valid TLS certificates is a common secure approach.

The best practice is to run the registry behind a reverse proxy (like Nginx) that manages TLS with valid certificates from a trusted CA. Self-signed certs require extra client config and insecure registries are discouraged.

Practice

1. What is the main purpose of setting up a private Docker registry?

easy

A. To automatically update Docker images from Docker Hub

B. To speed up Docker container execution

C. To store Docker images securely within your own network

D. To monitor running Docker containers

Solution

1. Step 1: Understand what a Docker registry does

   A Docker registry stores Docker images so they can be shared and reused.

2. Step 2: Identify the benefit of a private registry

   A private registry keeps images secure and accessible only within your network.

3. Final Answer:

   To store Docker images securely within your own network -> Option C

4. Quick Check:

   Private registry = secure image storage [OK]

Hint: Private registry means secure image storage inside your network [OK]

Common Mistakes:

• Confusing registry with container runtime
• Thinking it speeds up container execution
• Assuming it automatically updates images

2. Which command correctly starts a private Docker registry on port 5000?

easy

A. docker start registry -p 5000:5000

B. docker build -t registry:5000 .

C. docker create registry -p 5000:5000

D. docker run -d -p 5000:5000 --name registry registry:2

Solution

1. Step 1: Identify the correct Docker command to run a container

   The command to start a container is 'docker run' with port mapping.

2. Step 2: Check the syntax for running the registry image

   docker run -d -p 5000:5000 --name registry registry:2 uses 'docker run -d -p 5000:5000 --name registry registry:2' which is correct.

3. Final Answer:

   docker run -d -p 5000:5000 --name registry registry:2 -> Option D

4. Quick Check:

   Run container with port 5000 mapped = docker run -d -p 5000:5000 --name registry registry:2 [OK]

Hint: Use 'docker run -d -p 5000:5000' to start registry container [OK]

Common Mistakes:

• Using 'docker start' instead of 'docker run'
• Confusing 'docker create' with 'docker run'
• Trying to build instead of run the registry image

3. After running a private registry on localhost:5000, what is the correct command to tag an image named myapp for pushing to this registry?

medium

A. docker tag myapp localhost:5000/myapp

B. docker push myapp localhost:5000/myapp

C. docker tag localhost:5000/myapp myapp

D. docker run myapp localhost:5000/myapp

Solution

1. Step 1: Understand tagging for private registry

   To push an image to a private registry, you must tag it with the registry address first.

2. Step 2: Identify the correct tag command

   docker tag myapp localhost:5000/myapp uses 'docker tag myapp localhost:5000/myapp' which correctly tags the image.

3. Final Answer:

   docker tag myapp localhost:5000/myapp -> Option A

4. Quick Check:

   Tag image with registry address before push = docker tag myapp localhost:5000/myapp [OK]

Hint: Tag image as 'localhost:5000/name' before pushing [OK]

Common Mistakes:

• Trying to push without tagging first
• Reversing tag source and target
• Using 'docker run' instead of 'docker tag'

4. You tried to push an image to your private registry but got an error: denied: requested access to the resource is denied. What is the most likely cause?

medium

A. The registry container is not running

B. The image was not tagged with the private registry address

C. Docker daemon is not installed

D. The image name contains invalid characters

Solution

1. Step 1: Understand the error meaning

   The error means Docker cannot find the image at the specified registry path.

2. Step 2: Check tagging before pushing

   If the image is not tagged with the private registry address, push will fail with this error.

3. Final Answer:

   The image was not tagged with the private registry address -> Option B

4. Quick Check:

   Push denied = missing correct tag [OK]

Hint: Check if image is tagged with registry address before push [OK]

Common Mistakes:

• Assuming registry container is stopped without checking
• Thinking Docker daemon is missing
• Blaming image name format without evidence

5. You want to secure your private Docker registry with TLS. Which of these steps is necessary to enable HTTPS access?

hard

A. Mount your TLS certificate and key into the registry container and configure the registry to use them

B. Run the registry container with the --tls flag without any certificates

C. Tag images with https:// prefix before pushing

D. Use Docker Hub instead of a private registry

Solution

1. Step 1: Understand TLS setup for private registry

   To enable HTTPS, the registry needs valid TLS certificates mounted and configured.

2. Step 2: Identify correct method to provide TLS certs

   Mounting the certificate and key files into the container and configuring the registry is required.

3. Final Answer:

   Mount your TLS certificate and key into the registry container and configure the registry to use them -> Option A

4. Quick Check:

   TLS requires certs mounted and configured [OK]

Hint: Mount TLS certs into registry container for HTTPS [OK]

Common Mistakes:

• Expecting a --tls flag to work without certs
• Tagging images with https:// prefix
• Using Docker Hub instead of securing private registry