Setting up private registry in Docker - Practice Exercises

Challenge - 5 Problems

💻 Command Output

intermediate

Docker command to start a private registry

What is the output of the command when you start a Docker private registry with the following command?

docker run -d -p 5000:5000 --name registry registry:2

Assume Docker is installed and the command runs successfully.

Docker

docker run -d -p 5000:5000 --name registry registry:2

A A container ID string is printed, indicating the registry container started in detached mode.

B Error: image 'registry:2' not found locally and no pull access.

C The command outputs 'Registry started on port 5000'.

D The command outputs 'Permission denied' due to port binding.

💡 Hint

Detached mode (-d) returns the container ID if successful.

Running the registry container in detached mode returns the container ID. It does not print a message like 'Registry started'. If the image is missing, Docker pulls it automatically unless there's no access.

❓ Configuration

intermediate

Configuring Docker daemon to trust insecure registry

You want Docker on your client machine to trust a private registry running on localhost:5000 without TLS. Which configuration snippet should you add to /etc/docker/daemon.json to allow this?

A

{
  "registry-mirrors": ["http://localhost:5000"]
}

B

{
  "trusted-registries": ["localhost:5000"]
}

C

{
  "allow-insecure": true
}

D

{
  "insecure-registries": ["localhost:5000"]
}

💡 Hint

Docker uses 'insecure-registries' key for this purpose.

The Docker daemon configuration uses the 'insecure-registries' key to list registries that do not use TLS. Other keys like 'trusted-registries' or 'allow-insecure' do not exist.

🔀 Workflow

advanced

Steps to push an image to a private registry

Which sequence of commands correctly pushes a local Docker image named myapp:latest to a private registry running on localhost:5000?

A 4,3,1,2

B 4,1,3,2

C 1,4,3,2

D 3,4,1,2

💡 Hint

You must build the image first, then login, tag, and push.

First build the image locally, then login to the private registry, tag the image with the registry address, and finally push it.

❓ Troubleshoot

advanced

Diagnosing Docker push failure to private registry

You try to push an image to your private registry at localhost:5000 but get the error:

denied: requested access to the resource is denied

What is the most likely cause?

A You forgot to login to the private registry before pushing.

B Docker daemon is not configured to allow insecure registries.

C The image name is missing the registry prefix.

D The private registry container is not running.

💡 Hint

Check if the image name includes the registry address.

The error usually means Docker is trying to push to Docker Hub instead of your private registry because the image name lacks the registry prefix like 'localhost:5000/'.

✅ Best Practice

expert

Securing a private Docker registry with TLS

Which of the following is the best practice to secure a private Docker registry running on your server?

A Run the registry without TLS and configure clients to use insecure registries.

B Run the registry behind a reverse proxy that handles TLS termination with valid certificates.

C Run the registry with self-signed TLS certificates and configure clients to trust them.

D Use HTTP only and restrict access by IP firewall rules.

💡 Hint

Using a reverse proxy with valid TLS certificates is a common secure approach.

The best practice is to run the registry behind a reverse proxy (like Nginx) that manages TLS with valid certificates from a trusted CA. Self-signed certs require extra client config and insecure registries are discouraged.