Skip to content

docs: Added section explaining how RAM configurations restricting Docker hub interacts with mirror registries #22474

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Apr 24, 2025
Merged

docs: Added section explaining how RAM configurations restricting Docker hub interacts with mirror registries #22474

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3f2b867
Added section explaining how RAM configurations restricting Docker hu…
chaomonica Apr 22, 2025
6ea4f74
Improved wording and commands
chaomonica Apr 22, 2025
dcaac70
Responded to feedback
chaomonica Apr 23, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions content/manuals/docker-hub/image-library/mirror.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,21 @@
The Registry can be configured as a pull through cache. In this mode a Registry
responds to all normal docker pull requests but stores all content locally.

### Using Registry Access Management (RAM) with a registry mirror

Check warning on line 48 in content/manuals/docker-hub/image-library/mirror.md

View workflow job for this annotation

GitHub Actions / vale 

[vale] reported by reviewdog 🐶
[Docker.HeadingLength] Try to keep headings short (< 8 words).

Raw Output:
{"message": "[Docker.HeadingLength] Try to keep headings short (\u003c 8 words).", "location": {"path": "content/manuals/docker-hub/image-library/mirror.md", "range": {"start": {"line": 48, "column": 5}}}, "severity": "INFO"}

If Docker Hub access is restricted via your Registry Access Management (RAM) configuration, you will not be able to pull images originating from Docker Hub even if the images are available in your registry mirror.

You will encounter the following error:
```console
Error response from daemon: Access to docker.io has been restricted by your administrators.
```

If you are unable to allow access to Docker Hub, you can manually pull from your registry mirror and optionally, retag the image. For example:

Check warning on line 57 in content/manuals/docker-hub/image-library/mirror.md

View workflow job for this annotation

GitHub Actions / vale 

[vale] reported by reviewdog 🐶
[Docker.RecommendedWords] Consider using 'let' instead of 'allow'

Raw Output:
{"message": "[Docker.RecommendedWords] Consider using 'let' instead of 'allow'", "location": {"path": "content/manuals/docker-hub/image-library/mirror.md", "range": {"start": {"line": 57, "column": 22}}}, "severity": "INFO"}

Check failure on line 57 in content/manuals/docker-hub/image-library/mirror.md

View workflow job for this annotation

GitHub Actions / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'retag'?

Raw Output:
{"message": "[Vale.Spelling] Did you really mean 'retag'?", "location": {"path": "content/manuals/docker-hub/image-library/mirror.md", "range": {"start": {"line": 57, "column": 114}}}, "severity": "ERROR"}
```console
docker pull <your-registry-mirror>[:<port>]/library/busybox
docker tag <your-registry-mirror>[:<port>]/library/busybox:latest busybox:latest
```

## How does it work?

The first time you request an image from your local registry mirror, it pulls
Expand Down
1 change: 1 addition & 0 deletions content/manuals/security/for-admins/hardened-desktop/registry-access-management.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,6 +89,7 @@ earlier Linux kernel series).
This will be resolved in the updated 5.15 series Linux kernel.
- Images pulled by Docker Desktop when Docker Debug or Kubernetes is enabled,
are not restricted by default even if Docker Hub is blocked by RAM.
- If Docker Hub access is restricted by RAM, pulls on images originating from Docker Hub are restricted even if the image has been previously cached by a registry mirror. See [Using Registry Access Management (RAM) with a registry mirror](/manuals/docker-hub/image-library/mirror.md).

Also, Registry Access Management operates on the level of hosts, not IP
addresses. Developers can bypass this restriction within their domain
Expand Down