Article Image
read

After moving Traefik to v2, I also updated the common registry infrastructure. Namely, this stack has a UI infront of the registry, hosts the registry volume on an NFS store, and has an auto-garbage-collection image that runs once every 24 hours (With nothing fancier than some swarm config!)

Docker Swarm Stack

Please note that there are several variables in the below config I use to abstract secrets/hosts/etc. You'll need to fill in these before they can work.

Also note that you can replace the NFS volume with a normal volume, but if you do, make sure to pin the two containers that use the volume to the node that contains the volume.

version: "3.3"
services:
  # This registry is ONLY on the local net
  # and will be fronted by the registryui
  registry:
    image: registry:2
    environment:
      REGISTRY_HTTP_SECRET: some-secret-to-be-used-here
    volumes:
      - registry-data:/var/lib/registry
    environment:
      REGISTRY_STORAGE_DELETE_ENABLED: 'true'
    deploy:
      replicas: 1
      restart_policy: { condition: on-failure }
      resources:
        limits: { cpus: '0.2', memory: '48M' }
        reservations: { cpus: '0.05', memory: '32M' }

  registry-cleanup:
    image: registry:2
    command: garbage-collect /etc/docker/registry/config.yml
    volumes:
      - registry-data:/var/lib/registry
    deploy:
      replicas: 1
      restart_policy:
        delay: 24h
      resources:
        limits: { cpus: '0.1', memory: '32M' }
        reservations: { cpus: '0.025', memory: '16M' }

  registryui:
    image: joxit/docker-registry-ui:static
    networks:
      - default
      - traefik-net
    environment:
      REGISTRY_TITLE: 'Registry'
      DELETE_IMAGES: 'true'
      REGISTRY_URL: http://registry:5000
    depends_on:
      - registry
    deploy:
      labels:
        - "traefik.enable=true"
        - "traefik.docker.network=traefik-net"
        - "traefik.http.routers.registry.rule=Host(`registry.${HOST}`)"
        - "traefik.http.services.registry.loadbalancer.server.port=80"
        - "traefik.http.routers.registry.entrypoints=websecure"
        - "traefik.http.routers.registry.middlewares=registry-auth"
        - "traefik.http.middlewares.registry-auth.basicauth.users=${GLOBAL_HTPASSWD}"
      resources:
        limits: { cpus: '0.2', memory: '32M' }
        reservations: { cpus: '0.05', memory: '16M' }

networks:
  traefik-net:
    external:
      name: 'traefik-net'

volumes:
  registry-data:
    driver_opts:
      type: "nfs"
      o: "addr=${NFS},nolock,soft,rw"
      device: "${NFS_BASE}/registry"
Blog Logo

Christopher LaPointe


Published

Image

Chris LaPointe

Another site of Code

Back to Overview