Article Image
read
After moving Traefik to v2, I also updated the common registry infrastructure. Namely, this stack has a UI infront of the registry, hosts the registry volume on an NFS store, and has an auto-garbage-collection image that runs once every 24 hours (With nothing fancier than some swarm config!)
Docker Swarm Stack
Please note that there are several variables in the below config I use to abstract secrets/hosts/etc. You'll need to fill in these before they can work.
Also note that you can replace the NFS volume with a normal volume, but if you do, make sure to pin the two containers that use the volume to the node that contains the volume.
version: "3.3"
services:
# This registry is ONLY on the local net
# and will be fronted by the registryui
registry:
image: registry:2
environment:
REGISTRY_HTTP_SECRET: some-secret-to-be-used-here
volumes:
- registry-data:/var/lib/registry
environment:
REGISTRY_STORAGE_DELETE_ENABLED: 'true'
deploy:
replicas: 1
restart_policy: { condition: on-failure }
resources:
limits: { cpus: '0.2', memory: '48M' }
reservations: { cpus: '0.05', memory: '32M' }
registry-cleanup:
image: registry:2
command: garbage-collect /etc/docker/registry/config.yml
volumes:
- registry-data:/var/lib/registry
deploy:
replicas: 1
restart_policy:
delay: 24h
resources:
limits: { cpus: '0.1', memory: '32M' }
reservations: { cpus: '0.025', memory: '16M' }
registryui:
image: joxit/docker-registry-ui:static
networks:
- default
- traefik-net
environment:
REGISTRY_TITLE: 'Registry'
DELETE_IMAGES: 'true'
REGISTRY_URL: http://registry:5000
depends_on:
- registry
deploy:
labels:
- "traefik.enable=true"
- "traefik.docker.network=traefik-net"
- "traefik.http.routers.registry.rule=Host(`registry.${HOST}`)"
- "traefik.http.services.registry.loadbalancer.server.port=80"
- "traefik.http.routers.registry.entrypoints=websecure"
- "traefik.http.routers.registry.middlewares=registry-auth"
- "traefik.http.middlewares.registry-auth.basicauth.users=${GLOBAL_HTPASSWD}"
resources:
limits: { cpus: '0.2', memory: '32M' }
reservations: { cpus: '0.05', memory: '16M' }
networks:
traefik-net:
external:
name: 'traefik-net'
volumes:
registry-data:
driver_opts:
type: "nfs"
o: "addr=${NFS},nolock,soft,rw"
device: "${NFS_BASE}/registry"