unkin-agent
32da0fd750
Add ARTIFACTAPI_AUTH_UPLOADS to require a verified token for local uploads, deletes, evictions, /api/v1 publishes and /v2 push. Accept the token as Bearer, Token, Basic password or bare header, and serve a Docker registry token endpoint so pulls stay anonymous.
21 lines
983 B
Markdown
21 lines
983 B
Markdown
# Local docker registry
|
|
|
|
A local `docker` repo is a real container registry, not a mirror: it serves the
|
|
Docker Registry HTTP API V2 for both push and pull, so any client (`docker`,
|
|
`podman`, `skopeo`, `buildah`) can use it directly.
|
|
|
|
```sh
|
|
docker tag myapp:latest artifactapi.example.com/docker-internal/myapp:latest
|
|
docker push artifactapi.example.com/docker-internal/myapp:latest
|
|
docker pull artifactapi.example.com/docker-internal/myapp:latest
|
|
```
|
|
|
|
With [uploads gated](../common/auth.md), `docker login` with any username and
|
|
a token as the password before pushing; pulls stay anonymous.
|
|
|
|
The first path segment after `/v2/` is the artifactapi repo name; the remainder
|
|
is the image name. Blobs and manifests are stored through the shared
|
|
content-addressable store (deduplicated by digest, reaped by GC once
|
|
unreferenced); tags are mutable references and re-pushing a tag moves it. Blob
|
|
uploads support both the monolithic and chunked (`POST`/`PATCH`/`PUT`) flows.
|