4

In Nexus, go to the Admin Backend. Create a blob store if you haven't already. Guidance can be found here: https://help.sonatype.com/repomanager3/configuration/repository-management#RepositoryManagement-BlobStores Once you have a blob store, continue like so: Choose "Repositories", hit "Create Repository". Choose "docker (proxy)" as the recipe. Give it ...


3

I do not believe that there is a way to set this as a global policy. However, there is a simple command you can run that will "prune" or remove your unused images. You will want to use docker image prune --filter [options] to achieve this. Check out the official documentation for information on how to best filter. As a best practice you should be tagging ...


3

With Docker following the Open Container Initiative, in the event that Docker were to disappear, people would still have access to images stored outside of Docker Hub. While there is not a public mirror of Docker Hub, you do have access to other registries that often store the official image. For example, if you were to pull the official Docker SQL Server ...


3

At first glance, it seems that tag immutability is not a feature provided by Quay. You can enable "Trust and Signing" in the "settings" of the repo: Please note that this will not prevent users from overwriting signed tags without updating signatures. This means that: Any tag operations in the UI or client can cause inconsistency Builds ...


3

So it turned out that some of the workers didn't have the correct credentials to the docker registry. After I applied the correct ones, the command worked normally. That's weird, since I could do it locally... Anyway, case solved.


2

If task definition is using "latest" as image tag in container definition,to update ecs service in order to pull new image from ECR with "latest" tag. You can simply do Force new deployment aws ecs update-service --cluster --service --force-new-deployment --profile All though using "latest" tag for deployment is not good practice


2

Options are: Use CodeBuild to push the new image. Make sure the task definition is using the "latest" tag. You'll need to force the deployment of the task definition to pick the new image. Use CodePipeline to update ECS. It will automatically generate a new task definition revision with the new image and deploy it.


2

First of all 404 error is resource error in kubernetes. It means your container in the pod is not created by your first script. Even if it is created and you can see it then your labeling is wrong in the second script. I would suggest you check matchlabels of both YAML scripts. So in your case I can see that matchlabel is docker-registry in the spec ...


2

You need the --with-registry-auth flag, e.g.: docker stack deploy -c myapp.yml --with-registry-auth myapp From the docker stack deploy --help output: --with-registry-auth Send registry authentication details to Swarm agents


2

It looks like that the docker login and the docker build were done by different users. If a docker login is performed, then a ~/.docker directory will be created in the namespace of user X, if the build is done by user Y then the latter user does not have a .docker folder and is not authorized to pull the image. One could verify this by echo $USER in the ...


2

You cannot change the default registry (see this). You have to specify which registry to use like this: docker pull myprivatereg:port/library/image Or, in a Dockerfile: FROM myprivatereg:port/library/image (This question was also asked in StackOverlow).


2

A related Q&A was already created on StackOverflow back in the day. Several answers simply do a docker pull image-to-be-checked. If exit 0, the image exists in a certain registry. If not then the image seems to be omitted. However, if an image is large, e.g. X>1GB or the (office) internet is slow (due to proxies), this could take a while. The best ...


2

Yes, As we write terraform template is correct. When you use terraform apply it will check local docker image list if it doesn't exit it will go to find registry as you define docker image. If you don't want a pull image from the internet you can try the below steps. But at least you should have a base docker image of any Linux distribution. Create a ...


1

From docs: -B Use bcrypt encryption for passwords. This is currently considered to be very secure. -b Use batch mode; i.e., get the password from the command line rather than prompting for it. This option should be used with extreme care, since the password is clearly visible on the command line. For script use see the -i option. Available in 2.4.4 and ...


1

So I ended up using this simple shell script docker images -q --filter "before=ecr.us-east-1.amazonaws.com/myapp:02e56bac4ee3f27a4d5670a6ac0d578e3dd5b2e5" | xargs docker rmi --force First you filter your images to list only those created before the latest one (you either know your recent tag or just use latest one) The you just remove those images with ...


1

Actually this is not possible as docker push command will look for a local image or a repository. You will have to load your image first from tar file, the push it to your registry. docker load --input repo.tar docker image tag myrepo registry-host:5000/myrepo/myrepo:v1 docker image push registry-host:5000/myrepo/myrepo:v1


1

tl;dr You can execute the following to pin the public root key for debian: sudo su - mkdir -p /root/.docker/trust/tuf/docker.io/library/debian/metadata chown -R root:root /root/.docker chmod -R 0700 /root/.docker echo '{"signed":{"_type":"Root","consistent_snapshot":false,"expires":"2025-08-07T20:55:22....


1

Look into Payara. It's a Glassfish fork/drop-in replacement that's better in most ways, including support. There is a Payara 5 docker image available right on docker hub: https://hub.docker.com/r/payara/server-full


1

Found the issue, had: kubectl -n jenkins patch serviceaccount jenkins -p '{"imagePullSecrets": [{"name": "gcr-json-key"}]}' ... applied on default serviceaccount instead of jenkins.


1

I think what you are doing wrong is the way you specify the credentialID to be used. Instead of 'awsId' try to use 'ecr:ap-southeast-1:awsId' docker.withRegistry('https://01234.dkr.ecr.ap-southeast-1.amazonaws.com/', 'ecr:ap-southeast-1:awsId') { def image = docker.image("01234.dkr.ecr.ap-southeast-1.amazonaws.com/tas/master-server:${env.BUILD_ID}") ...


1

The docker login failed. Error response from daemon: Get https://https/v2/: dial tcp: lookup https: Temporary failure in name resolution The url is invalid. change from docker login -u AWS -p ******** https:/123456790.dkr.ecr.us-east-1.amazonaws.com to docker login -u AWS -p ******** 123456790.dkr.ecr.us-east-1.amazonaws.com


1

Try to chain withRegistry like this: docker.withRegistry('https://registry:10500', 'credentials-id') { docker.withRegistry('https://registry:10501', 'credentials-id') { docker.build(imageToBuild.getName(), '-f ' + imageToBuild.tag + '.Dockerfile .').push(); } }


1

Try to check is registry really stopped using docker ps -a if container runned stop container then start. Part related to the --restart always option, restart always will proceed only if container works at least 10 seconds and docker itself can monitor this service. See more info at this link restart policy detail


1

I learned that it's not required to set the ingress class to nginx as I did in kubernetes.io/ingress.class: nginx. All annotations prefixed with nginx.ingress.kubernetes.io apply to the default Kubernetes ingress. Setting the timeouts is also not required. The only important annotation is nginx.ingress.kubernetes.io/proxy-body-size: "0" because the default ...


1

I am using AzureDevOps and the trick we use when naming containers is to add build number to the label namespace/application:branch-name-bulidNumber So in your case, you could try gitlab variable CI_CONCURRENT_PROJECT_ID After comment for images clean-up you can use: docker image prune --all --filter until=48h As docker system prune and docker image ...


1

We have a script which we run periodicaly which scans our docker registry for orphaned items, and then deletes them. Unfortunately, it requires multiple API calls to get all the data required, and then to delete each image. But basically, if an image hash is lacking a 'latest' tag or a tag that starts with 'v' it gets culled. You could probably also try ...


Only top voted, non community-wiki answers of a minimum length are eligible