quiq / docker-registry-ui

Web UI for Docker Registry

Registry UI

Overview

• Web UI for Docker Registry or similar alternatives
• Fast, simple and small package
• Browse catalog of repositories and tags
• Show an arbitrary level of repository tree
• Support Docker and OCI image formats
• Support image and image index manifests (multi-platform images)
• Display full information about image index and links to the underlying sub-images
• Display full information about image, its layers and config file (command history)
• Event listener for notification events coming from Registry
• Store events in Sqlite or MySQL database
• CLI option to maintain the tag retention: purge tags older than X days keeping at least Y tags etc.
• Automatically discover an authentication method: basic auth, token service, keychain etc.
• The list of repositories and tag counts are cached and refreshed in background

No TLS or authentication is implemented on the UI instance itself. Assuming you will put it behind nginx, oauth2_proxy or similar.

Docker images quiq/registry-ui

Configuration

The configuration is stored in config.yml and the options are self-descriptive.

Run UI

docker run -d -p 8000:8000 -v /local/config.yml:/opt/config.yml:ro quiq/registry-ui

To run with your own root CA certificate, add to the command:

-v /local/rootcacerts.crt:/etc/ssl/certs/ca-certificates.crt:ro

To preserve sqlite db file with event data, add to the command:

-v /local/data:/opt/data

Ensure /local/data is owner by nobody (alpine user id is 65534).

You can also run the container with --read-only option, however when using using event listener functionality you need to ensure the sqlite db can be written, i.e. mount a folder as listed above (rw mode).

To run with a custom TZ:

-e TZ=America/Los_Angeles

Configure event listener on Docker Registry

To receive events you need to configure Registry as follow:

notifications:
  endpoints:
    - name: registry-ui
      url: http://registry-ui.local:8000/event-receiver
      headers:
        Authorization: [Bearer abcdefghijklmnopqrstuvwxyz1234567890]
      timeout: 1s
      threshold: 5
      backoff: 10s
      ignoredmediatypes:
        - application/octet-stream

Adjust url and token as appropriate. If you are running UI with non-default base path, e.g. /ui, the URL path for above will be /ui/event-receiver etc.

Using MySQL instead of sqlite3 for event listener

To use MySQL as a storage you need to change event_database_driver and event_database_location settings in the config file. It is expected you create a database mentioned in the location DSN. Minimal privileges are SELECT, INSERT, DELETE. You can create a table manually if you don't want to grant CREATE permission:

CREATE TABLE events (
	id INTEGER PRIMARY KEY AUTO_INCREMENT,
	action CHAR(4) NULL,
	repository VARCHAR(100) NULL,
	tag VARCHAR(100) NULL,
	ip VARCHAR(15) NULL,
	user VARCHAR(50) NULL,
	created DATETIME NULL
);

Schedule a cron task for purging tags

To delete tags you need to enable the corresponding option in Docker Registry config. For example:

storage:
  delete:
    enabled: true

The following example shows how to run a cron task to purge tags older than X days but also keep at least Y tags no matter how old. Assuming container has been already running.

10 3 * * * root docker exec -t registry-ui /opt/registry-ui -purge-tags

You can try to run in dry-run mode first to see what is going to be purged:

docker exec -t registry-ui /opt/registry-ui -purge-tags -dry-run

Screenshots

Repository list:

Tag list:

Image Index info:

Image info:

docker-registry-ui's Issues

cannot initialize api client or unsupported auth method

root@DEB-NUC10i5F-G6FN04300231:~/samadhan/scorer/Manufacturing# docker logs scorer_registry_ui 
time="2022-10-18T19:39:25Z" level=error msg="Get \"https://127.0.0.1:11000/v2/\": dial tcp 127.0.0.1:11000: connect: connection refused" logger=registry.client
panic: cannot initialize api client or unsupported auth method
goroutine 1 [running]:
main.main()
        /opt/src/main.go:114 +0x1825
   ____    __
  / __/___/ /  ___
 / _// __/ _ \/ _ \
/___/\__/_//_/\___/ v4.1.16
High performance, minimalist Go web framework
https://echo.labstack.com
____________________________________O/_______
                                    O\
⇨ http server started on [::]:9010
root@DEB-NUC10i5F-G6FN04300231:~/samadhan/scorer/Manufacturing# 

config.yml path by env variable

Hello, just tried to deploy it in kubernetes with no success. Is there option to pass config.yml path by Environment variable?
meaning if I mount configmap with the config.yml key to /myconfig, how can I pass this path (/myconfig/config.yml) to the app?

Unsupported platform on arm64v8 RPI4

This image doesn't have ARMv8 architecture and cannot be used on RaspberryPi 4 hardware as for now...

panic: event_database_driver should be either sqlite3 or mysql

Hello,

after update latest version the app cannot running.

Error message.
panic: event_database_driver should be either sqlite3 or mysql

Please help Thanks'

[Question] How to secure registry-ui in a public environment?

Currently registry-ui doesn't have mechanism to authen against multiple users, the config.yml specify a fixed setup for the user to login, its password, type of even_listener - I'm using ldap and token.

How to make it possible to authen users - probably a dialog box and then check against if that user exists in ldap and has correct password then hand out token?

The home page can only list 100 images.

According to the docker registry api reference

A registry may also limit the amount of responses returned even if pagination was not explicitly requested

so in registry/client.go . it was
data, _ := c.callRegistry("/v2/_catalog", scope, 2, false)
the api only return 100 results.

I am not good at golang coding，could any one help to change this？

Thanks

how used with no auth.

registry.client - ERROR - Get https://localhost/v2/: dial tcp 127.0.0.1:443: connect: connection refused
panic: cannot initialize api client or unsupported auth method

I just use https, not support auth. can anyway skip auth.

Authentication by requesting auth token for AWS ECR

When running towards AWS ECR it would be a good addition to be able to set region and registry ID in config and let the application fetch credentials based on IAM roles.

Doesn't work well when not serving from root

Hi,
I'm using your UI for my private registry. My idea was to server the registry from docker.domain.com and the UI from docker.domain.com/ui. Unfortunately the UI can't deal with that configuration.

What I noticed:

• Event Log link is pointing to /events
• Table is empty (but there are entries when serving from /)
• Breadcrumb wrong

Stick to the chosen namespace + pick one if no image

I have a registry with token auth enabled but I'm unable to list images/tags. The UI shows "No data available in table", however the logs show that a token is correctly fetched and then when endpoints are targeted they respond with coherent data.

I tried to mount /opt/data as a folder and even make it writable by user nobody by adding the following lines to a custom Dockerfile :

USER root
RUN chown nobody:nogroup /opt/data
USER nobody

But I'm still unable to have a list of tags and I don't see any database file created. Do you have any idea what's going on ? Do you keep tags in a database ?

Thanks for the help ☺️

Go binary without Docker?

Is it possible to provide a pure go binary?
I would create a suitable Ansible role for this.

[Bug] Image and layer size is empty

I have the case where the docker registry tells that each layer has a size of 0. This prevents the tag_info template from behind rendered. I can overcome the issue by changing the template to test if there is a size, but it seems to me that this is a bigger problem. As the layer do have a non-0 size

docker-registry-ui container restarting. panic: yaml: line 83: did not find expected key

Issue:
Encountered a panic error in Docker Registry UI, specifically: "yaml: line 83: did not find expected key".

Steps Taken:

1. Pull Image: Pulled quiq/docker-registry-ui:0.9.2 image successfully.

2. Run Docker Container: Executed the container with the following command:

   docker container run --detach --restart=always --network host \
   --volume /opt/scorer/etc/registry-ui/config.yml:/opt/config.yml:ro \
   --volume /opt/scorer/lib/mkcert/.ca/rootCA.pem:/etc/ssl/certs/ca-certificates.crt:ro \
   --volume /opt/scorer/lib/registry_ui:/opt/data:rw \
   --name ecr_registry_ui quiq/docker-registry-ui:0.9.2 -log-level=warn
   

3. Successfully pulled the image

Unable to find image 'quiq/docker-registry-ui:0.9.2' locally
0.9.2: Pulling from quiq/docker-registry-ui
df20fa9351a1: Pull complete 
f6055706147d: Pull complete 
5a88b35edf20: Pull complete 
dbc6941eb5d6: Pull complete 
8af3aa088aeb: Pull complete 
Digest: sha256:dd3087d83abc570c0115a3198e960d54296744806360753d86739823a87bf7b5
Status: Downloaded newer image for quiq/docker-registry-ui:0.9.2
52fa13978095182bda83721c0a1e9c859ce357d510211622a5a1cb5d370a432d

3. Check Container Status: Noticed the docker-registry-ui container repeatedly restarting.

   # docker ps -a | grep registry 
   
   52fa13978095   quiq/docker-registry-ui:0.9.2   "/opt/docker-registr…"   5 seconds ago   Restarting (2) 1 second ago   ecr_registry_ui
   358ba07b4b9d   registry:2   "/entrypoint.sh /etc…"   17 seconds ago   Up 16 seconds   ecr_registry
   

4. Inspect Container Logs: Examined the logs for the ecr_registry_ui container and found repeated occurrences of the panic error referencing line 83 in main.go.

root@DEB-NUC10i5F-G6FN04300231:~# docker logs ecr_registry_ui
panic: yaml: line 83: did not find expected key

goroutine 1 [running]:
main.main()
	/opt/src/main.go:83 +0x1886
panic: yaml: line 83: did not find expected key

goroutine 1 [running]:
main.main()
	/opt/src/main.go:83 +0x1886
panic: yaml: line 83: did not find expected key

goroutine 1 [running]:
main.main()
	/opt/src/main.go:83 +0x1886
panic: yaml: line 83: did not find expected key

goroutine 1 [running]:
main.main()
	/opt/src/main.go:83 +0x1886
panic: yaml: line 83: did not find expected key

goroutine 1 [running]:
main.main()
	/opt/src/main.go:83 +0x1886
panic: yaml: line 83: did not find expected key

goroutine 1 [running]:
main.main()
	/opt/src/main.go:83 +0x1886
panic: yaml: line 83: did not find expected key

goroutine 1 [running]:
main.main()
	/opt/src/main.go:83 +0x1886
panic: yaml: line 83: did not find expected key

goroutine 1 [running]:
main.main()
	/opt/src/main.go:83 +0x1886
panic: yaml: line 83: did not find expected key

goroutine 1 [running]:
main.main()
	/opt/src/main.go:83 +0x1886

Environment :

# cat /etc/os-release 
PRETTY_NAME="Debian GNU/Linux 10 (buster)"
NAME="Debian GNU/Linux"
VERSION_ID="10"
VERSION="10 (buster)"
VERSION_CODENAME=buster
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"
root@DEB-NUC10i5F-G6FN04300231:~/chetan/scorer/Manufacturing/debian/scripts# 

Restrict access to events

The event log (at /events and on the individual tag pages) contains some potentially identifying information such as the association between user/IP that you may not want to share widely with everyone.

Would it be possible to optionally restrict events visibility to admins, in the same way that you can restrict delete permissions?

Something like this in the config file:

# If users can view events. If set to False, then only admins listed below.
anyone_can_view_events: false

Example of config.yml

container won't start with only this command without its config.yml

docker run -d -p 8000:8000 -v /local/config.yml:/opt/config.yml:ro \
>     --name=registry-ui quiq/docker-registry-ui

I wonder where to find a sample for this image or howto write one?

To extend, what would it be to use token authentication?

Can't build, dependency issue

When trying to go build there seems to be a dependency issue:

go: github.com/mattn/[email protected]+incompatible: reading github.com/mattn/go-sqlite3/go.mod at revision v2.0.3: unknown revision v2.0.3

Looking at https://github.com/mattn/go-sqlite3, there seems to be no v2 (there was at one point, but was a mistake ?)

Sorting Images

Currently, I'm only able to sort images by their image names. I would like to be able to sort on other things, mostly just on the age of the image. It would be nice to be able to sort and get the oldest / newest images.

Thanks!

css: tag page TD width is burst

the field of moby.buildkit.buildinfo.v1 in Image History
has a long (but without space) line base64, which burst the cell width.

os: ubuntu
browser: chrome 113, firefox 113

-purge-tags does not check if delete is enabled

When running

docker exec -t registry-ui /opt/docker-registry-ui -purge-tags

there is no obvious feedback indicating that it did not delete anything if the registry does not have delete enabled. Since delete is disabled by default in docker registries, I would expect some feedback, and preferrably some fail-fast mechanism. This is a big time waster. Running this process takes about 40 minutes on my registry, multiply that by 2 since ppl probably dry-run this first.

Same actually goes for the web UI, there is no indication of the failure in the UI, only that the tag did no disappear.

duplicate image of library namespace

problem:

on perticually conditions ,

docker.registry.com/v2/_catalog

returns duplicate name:

{"repositories":["busybox","library/busybox","library/ubuntu","ubuntu"]}

then here adds the image twice to the list:

then causes:

Deleting a manifest list only deletes the first manifest

I use manifest lists to cover multi-architecture images (v4.0.1 manifest list contains v4.0.1-amd64, v4.0.1-arm, v4.0.1-arm64 manifests). The UI properly displays the manifest list when clicked on and shows the expected details for the 3 amd64/arm/arm64 manifests.

Using the Delete button for the manifest list results in the first manifest getting deleted (in my case the v4.0.1-amd64 manifest) instead of the manifest list getting removed. Additionally the automatic delete function removes the individual manifests as expected but leaves the manifest lists. The manifest lists successfully delete when passing the SHA256 hash to the docker registry REST endpoint. I think that docker-registry-ui is using the wrong digest for manifest lists.

I believe the attached log file quiq-docker-registry-ui_delete.txt helps demonstrate the issue.

• The manifest list for app_name:4.0.1 has digest "cace61c076b1f4f186f323eab626300bee5493f8d80b4e2b7ace8d303b675095"
• Manifest #1 has digest of "eaf66f4047adcb7f40ef92f66371538fdc9923ca3bfc78ddfeb937333b3adc19"

1. Line 5: docker-registry-ui GET docker-registry for the manifest list in response to the first Delete button click event for app_name:4.0.1
2. Line 8: docker-registry-ui DELETE docker-registry for the digest found in Manifest #1 used for app_name:4.0.1-amd64 instead of the digest for the manifest list
3. Line 9: docker-registry completes the DELETE command using the digest for app_name:4.0.1-amd64
4. Line 15: docker-registry-ui GET docker-registry for the manifest list in response to the first Delete button click event for app_name:4.0.1
5. Line 17: docker-registry fails on the DELETE command using the digest for app_name:4.0.1-amd64 as expected

Delete tag instead of manifest?

Let's say we have an image test:111. We tag it as test:222. Pushing both to the registry.
Then when we try to delete test:111, it will also remove test:222 because they have the same manifest sha256.

2019-01-10 10:40:09 - registry.client - INFO - DELETE /v2/test/manifests/sha256:9b55db467830702456b7de2fa28db87f01c6d0ed8ba5bde78b471d42db05c103 (111) 202 Accepted

Investigate whether it is possible to remove tag only (untag).

tags not listed when the catalog is deeper than 2

We use catalogs in the registry as folders.

e.g. ${company}/${project}/${module} as catalog name.

The ui does actually list the subrepositories when selecting the Namespace ${catalog} and also corretly shows the tag count, but when clicking on that catalog it ends in a empty tag list page.

The Link does contain the / as %F2 but also when entering the url with a / the ui will just list a "empty repository" which it is not ( http://server:5000/v2/dev-ploy/ploy-jnlp-slave/release/tags/list does list the correct tags, also the namespace overview does list the corret tag count)

http://server:8000/ui/dev-ploy/ploy-jnlp-slave%2Frelease
http://server:8000/ui/dev-ploy/ploy-jnlp-slave/release

datatable.min.xx is loaded from cdn

I have no internet in my environment, so when i try to launch registry-ui in shows only table skeletons, and in browser's networking tab datatables.min.xx files are i see that they are loaded from cdn.datatables.net.

Some flexibility for configuration parameters

Hi,

Needs some more flexibility in defining the configuration parameters.

For example:
To use in Docker Compose, may I overwrite some hardcoded parameters defined in config.yml file by value of environment variable for Docker container?

Deploy Docker Registry UI

hai,

i want to ask.. how to run this docker registry ui?

1. do i run docker build first? but where the example for docker build ?
2. when i run docker pull images existing and docker run, i got error like this :

root@docker-registry:/opt/docker/docker-registry-ui# docker run -d -p 8000:8000 -v /local/config.yml:/opt/config.yml:ro --name=registry-ui quiq/docker-registry-ui
25e5a27f5719ede17727127b2678ca68a5f9999fa559106f4e937f0e67e8ff00
root@docker-registry:/opt/docker/docker-registry-ui# docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
25e5a27f5719 quiq/docker-registry-ui "/opt/docker-registr…" 3 seconds ago Exited (2) 2 seconds ago registry-ui
root@docker-registry:/opt/docker/docker-registry-ui# docker logs registry-ui
panic: read config.yml: is a directory
goroutine 1 [running]:
main.main()
/opt/src/github.com/quiq/docker-registry-ui/main.go:71 +0x139b

3. when i run on folder example using docker compose i got error like this :

root@docker-registry:/opt/docker/docker-registry-ui/example# docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
1f3566d9b88c quiq/docker-registry-ui:latest "/opt/docker-registr…" 27 seconds ago Exited (2) 26 seconds ago example_registry-ui_1
fefb2e8721e3 registry:2 "/entrypoint.sh /etc…" 33 seconds ago Up 32 seconds (healthy) 0.0.0.0:32768->5000/tcp example_registry_1
80a76a5ffab1 httpd:2.4 "httpd-foreground" 33 seconds ago Up 32 seconds 0.0.0.0:80->80/tcp example_httpd_1
root@docker-registry:/opt/docker/docker-registry-ui/example# docker logs example_registry-ui_1
2018-09-13 03:48:21 - registry.client - ERROR - 503 Service Unavailable
panic: cannot initialize api client or unsupported auth method
goroutine 1 [running]:
main.main()
/opt/src/github.com/quiq/docker-registry-ui/main.go:105 +0x132a

any advice ?

stuck at calculating tags in background

Hello

i need some help with this UI please.

The logs show that it is stuck at this point :

sudo docker logs 124acce4eafb
2019-06-05 13:44:44 - registry.client - INFO - It was discovered the registry is configured with HTTP basic auth.

---

/ // / ___
/ // / _ / _
//_////___/ v3.3.10-dev
High performance, minimalist Go web framework
https://echo.labstack.com
_____________________________O/
O
⇨ http server started on [::]:8000
2019-06-05 13:44:44 - registry.client - INFO - Calculating tags in background...

i run it like so

sudo docker run -d -p 8000:8000 -v /home/ubuntu/docker-registry-ui/config.yml:/opt/config.yml:ro -v /home/ubuntu/docker-registry-ui/ca.crt:/etc/ssl/certs/ca-certificates.crt:ro --name=registry-ui quiq/docker-registry-ui

what could be wrong? thanks

unable to open database

Hi,
I am using your registry UI and I see an error messages in stdout:
Error selecting from table: unable to open database file2018-05-03 10:42:53

what does this mean? should I be worried about that?

Failed to get token for scope registry:catalog:*

For the first time when I run docker-compose up and check after registry-ui container is created, I always get message from docker logs <registry-ui_container_name>

Failed to get token for scope registry:catalog:*

Then if I trigger an action in web browser surfing http://<ip address of registry ui>:port, check registry-ui logs, it receives new token successfully.

Full logs:

2018-10-22 07:47:10 - registry.client - INFO - Calculating tags in background...
2018-10-22 07:47:10 - registry.client - ERROR - Failed to get token for scope registry:catalog:* from https://auth.example.com:5001/auth?service=my.docker.registry
2018-10-22 07:47:10 - registry.client - INFO - GET /v2/_catalog 401 Unauthorized
2018-10-22 07:47:10 - registry.client - INFO - Tags calculation complete.
2018-10-22 07:47:32 - registry.client - INFO - Received new token for scope repository:mozart/busybox:*
2018-10-22 07:47:32 - registry.client - INFO - GET /v2/mozart/busybox/manifests/latest 200 OK
2018-10-22 07:47:32 - registry.client - INFO - GET /v2/mozart/busybox/manifests/latest 200 OK
2018-10-22 07:47:33 - registry.client - INFO - Received new token for scope registry:catalog:*
2018-10-22 07:47:33 - registry.client - INFO - GET /v2/_catalog 200 OK

I had depends_on and command: to wait for registry:port and auth:port in registry-ui of docker-compose.yml

depends_on:
  - "auth"
  - "registry"
command: [ "./wait.sh", "auth:5001"]
command: ["./wait.sh", "registry:5000"]

Why registry-ui break the first time if I had force it wait for other services online? Is there something wrong, probably auth did wake late than registry-ui.

Purging tags for a selected repository

We have close to 40 repositories and almost 5 repositories in those with 20k tags. While I run a dry run of purge tags it is stuck with one of the repositories with close to 20k tags.

Also, how could I restrict purging to one of the repositories in them and restrict others.

LogEvent says '{"message":"Method Not Allowed"}'

I'm trying to setup LogEvents, where I already setup MySQL database and now I'm trying to setup register notification.

But when I perform curl -i -H "Authorization: Bearer $TOKEN register:8000/api/events

It responds with:
HTTP/1.1 405 Method Not Allowed
Content-Type: application/json; charset=UTF-8
Date: Wed, 16 Jan 2019 12:20:32 GMT
Content-Length: 32

{"message":"Method Not Allowed"}

base_path change is not working

Hi

I changed base_path to /ui but then i get a "{"message":"Not Found"}" on http://ip/ui and also on http://ip/
The same configuration without changing base_path is working as expected.
What do i wrong?

Thanks for your help

Error selecting from table: no such table: events

I'm using the latest image quiq/docker-registry-ui:latest and I run it with an /opt/data volume. When running ti is see this in the log:

   ____    __
  / __/___/ /  ___
 / _// __/ _ \/ _ \
/___/\__/_//_/\___/ v3.2.6
High performance, minimalist Go web framework
https://echo.labstack.com
____________________________________O/_______
                                    O\
⇨ http server started on [::]:8000
2018-05-25 21:36:19 - registry.client - INFO - Calculating tags in background...
2018-05-25 21:36:19 - registry.client - INFO - GET /v2/_catalog 200 OK
2018-05-25 21:36:20 - registry.client - INFO - GET /v2/busybox/tags/list 404 Not Found
2018-05-25 21:36:20 - registry.client - INFO - Tags calculation complete.
2018-05-25 21:36:27 - registry.client - INFO - GET /v2/busybox/tags/list 404 Not Found
Error selecting from table: no such table: events

I can see a registry_events.db file created in the data volume:

# ll
total 0
-rw-r--r--. 1 nfsnobody nfsnobody 0 May 25 14:31 registry_events.db

Timezone

It would be nice if the date/time displayed on the UI could use the timezone defined in an environnement variable (TZ environment variable on alpine)

Error 1406: Data too long for column 'action' at row 1

Error for action mount

2018-12-18 01:38:14 - events.event_listener - ERROR - Error inserting a row: Error 1406: Data too long for column 'action' at row 1

Allow verify a self signed CA

I have installed a registry with a self signed CA.
In order to trust my CA authority I added my CA certificate to /usr/local/share/ca-certificates by volume. But this is not sufficient. It seems I have to add it in /etc/ssl/certs/ca-certificates.crt too.

A procedure to add CA certificate in registry-ui would be appreciated.

SQLite Events DB file (registry_events.db) not created

Hello,

I am using the latest image of your Docker Registry UI (Image ID 'bfa6e6145cf8') and upon executing docker run command with (an empty) host directory mounted inside suggested container's directory '/opt/data' in order to have events logs, container is started successfully but I don't see the 'registry_events.db' file under '/opt/data' container's directory, as I would normally expect. The same happens If I don't mount any host directory to container's '/opt/data' directory.

Thus, when making any action in Registry's UI (I have configured the Registry as needed in order to send event notifications to UI), I receive the following error in container's logs :

events.event_listener - ERROR - Error creating a table: unable to open database file

Am I missing something? Isn't the SQLite DB file supposed to be created out-of-the-box upon container's startup?

PS : During docker run command, I am mounting the config file that exists in your project inside the container.

[feature request] provide docker registry metrics

Hi,

We're using docker-registry-ui, and I can't find an exporter when the storage backend is not a filesystem. I just thought that, since docker-registry-ui is already crawling the entire registry, why not provide metrics along as well?

I know it's a bit out of scope from docker-registry-ui, but looks like a very efficient way to provide an exporter.

Working kubernetes manifest

Posting this for those that will be looking for something like this. I have a working kubernetes manifest that works with cert-manger and traefik.

Please note to update container/image and config.yml as appropriate. Hope this helps.

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: docker-registry-ui
  namespace: docker-registry
spec:
  replicas: 1
  selector:
    matchLabels:
      name: docker-registry-ui
  template:
    metadata:
      labels:
        name: docker-registry-ui
    spec:
      containers:
        - name: docker-registry-ui
          image: docker-registry.local/cluster/docker-registry-ui
          args:
            - -config-file=/var/docker-registry-ui/config.yml
          resources: {}
          env:
            - name: TZ
              value: America/Los_Angeles
          ports:
            - containerPort: 8000
              protocol: TCP
              name: http
          volumeMounts:
            - mountPath: /opt/data
              name: data
            - mountPath: /var/docker-registry-ui
              name: config
      volumes:
        - name: config
          configMap:
            name: docker-registry-ui-config
        - name: data
          persistentVolumeClaim:
            claimName: docker-registry-ui-data
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: docker-registry-ui-config
  namespace: docker-registry
data:
  config.yml: |-
    # Listen interface.
    listen_addr: 0.0.0.0:8000
    # Base path of Docker Registry UI.
    base_path: /ui

    # Registry URL with schema and port.
    registry_url: https://docker-registry.local
    # Verify TLS certificate when using https.
    verify_tls: true

    # Docker registry credentials.
    # They need to have a full access to the registry.
    # If token authentication service is enabled, it will be auto-discovered and those credentials
    # will be used to obtain access tokens.
    # When the registry_password_file entry is used, the password can be passed as a docker secret
    # and read from file. This overides the registry_password entry.
    # registry_username: user
    # registry_password: pass
    # registry_password_file: /run/secrets/registry_password_file

    # Event listener token.
    # The same one should be configured on Docker registry as Authorization Bearer token.
    event_listener_token: token
    # Retention of records to keep.
    event_retention_days: 7

    # Event listener storage.
    event_database_driver: sqlite3
    event_database_location: data/registry_events.db
    # event_database_driver: mysql
    # event_database_location: user:password@tcp(localhost:3306)/docker_events

    # You can disable event deletion on some hosts when you are running docker-registry on master-master or
    # cluster setup to avoid deadlocks or replication break.
    event_deletion_enabled: True

    # Cache refresh interval in minutes.
    # How long to cache repository list and tag counts.
    cache_refresh_interval: 10

    # If users can delete tags. If set to False, then only admins listed below.
    anyone_can_delete: false
    # Users allowed to delete tags.
    # This should be sent via X-WEBAUTH-USER header from your proxy.
    admins: []

    # Debug mode. Affects only templates.
    debug: true

    # How many days to keep tags but also keep the minimal count provided no matter how old.
    purge_tags_keep_days: 90
    purge_tags_keep_count: 2
    # Enable built-in cron to schedule purging tags in server mode.
    # Empty string disables this feature.
    # Example: '25 54 17 * * *' will run it at 17:54:25 daily.
    # Note, the cron schedule format includes seconds! See https://godoc.org/github.com/robfig/cron
    purge_tags_schedule: ''
---
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: docker-registry-ui-data
  namespace: docker-registry
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 1Gi
---
apiVersion: v1
kind: Service
metadata:
  name: docker-registry-ui
  namespace: docker-registry
spec:
  ports:
    - name: http
      port: 80
      targetPort: http
  selector:
    name: docker-registry-ui
  type: ClusterIP
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: docker-registry-ui
  namespace: docker-registry
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-cluster
    traefik.ingress.kubernetes.io/frontend-entry-points: https
spec:
  tls:
    - hosts:
        - docker-registry.local
      secretName: docker-registry.local-cert
  rules:
    - host: docker-registry.local
      http:
        paths:
          - path: /ui
            backend:
              serviceName: docker-registry-ui
              servicePort: http

Fatal error template file: template repositories.html can't be loaded

root@DEB-NUC10i5F-G6FN04300231:~/samadhan/scorer/Manufacturing/debian/scripts# docker logs scorer_registry_ui 
   ____    __
  / __/___/ /  ___
 / _// __/ _ \/ _ \
/___/\__/_//_/\___/ v4.1.16
High performance, minimalist Go web framework
https://echo.labstack.com
____________________________________O/_______
                                    O\
⇨ http server started on [::]:9010
echo: http: panic serving 127.0.0.1:41048: Fatal error template file: template repositories.html can't be loaded
goroutine 5 [running]:
net/http.(*conn).serve.func1(0xc00038a000)
        /usr/local/go/src/net/http/server.go:1805 +0x153
panic(0x9c3e00, 0xc00005e070)
        /usr/local/go/src/runtime/panic.go:971 +0x499
main.(*Template).Render(0xc00041a008, 0xafd940, 0xc000380270, 0xa5b32d, 0x11, 0x9fa600, 0xc000380240, 0xb0e148, 0xc00038a0a0, 0xc00012a6c0, ...)
        /opt/src/template.go:24 +0x254
github.com/labstack/echo/v4.(*context).Render(0xc00038a0a0, 0xc8, 0xa5b32d, 0x11, 0x9fa600, 0xc000380240, 0x1, 0x0)
        /root/go/pkg/mod/github.com/labstack/echo/[email protected]/context.go:417 +0xc9
main.(*apiClient).viewRepositories(0xc000110100, 0xb0e148, 0xc00038a0a0, 0xc0003801e0, 0xc000057b08)
        /opt/src/main.go:186 +0x2bd
github.com/labstack/echo/v4.(*Echo).add.func1(0xb0e148, 0xc00038a0a0, 0x0, 0x0)
        /root/go/pkg/mod/github.com/labstack/echo/[email protected]/echo.go:512 +0x8f
github.com/labstack/echo/v4.(*Echo).ServeHTTP(0xc000428000, 0xb05e80, 0xc000392000, 0xc00038e000)

Remove repository if it doesn't contain any images

Steps to Reproduce

1. Push an image to your private registry.
2. Open the Docker Registry UI and visit the folder containing your pushed image.
3. Delete the image via Docker Registry UI.

Observed Behavior

The image is removed successfully. However the parent repository remains visible with zero images.

Feature Request

If the repository does not contain any images remove it from the list.

[Feature request] Add user based authentication for registry

Could the credentials for a token registry be provided by the user so that the token server checks the creds for permissions ?
I don't see how implementing authentication with a reverse proxy would not solve this use case.

Thanks ☺️

[Question] Howto secure registry-ui in public environment?

Currently registry-ui doesn't have mechanism to authen against multiple users, the config.yml specify a fixed setup for the user to login, its password, type of even_listener - I'm using ldap and token.

How to make it possible to authen users - probably a dialog box and then check against if that user exists in ldap and has correct password then hand out token?

404 error for pull-through cache and official images

Hello.
While I use local docker registry as pull-through cache, all official images from hub.docker.com ie https://hub.docker.com/_/mysql or https://hub.docker.com/_/python stored within my local registry with path library/python and library/mysql.
When I try to locate them by docker-registry-ui I find it in library namespace and docker-registry-ui request them by my-local-registry:5000/v2/python/tags/list

2018-12-17 08:50:15 - registry.client - INFO - GET /v2/python/tags/list 404 Not Found

instead of my-local-registry:5000/v2/library/python/tags/list

 $ curl -XGET -I https://my-local-registry:5000/v2/library/python/tags/list
HTTP/2 200 
server: nginx/1.15.6
date: Mon, 17 Dec 2018 09:07:22 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
docker-distribution-api-version: registry/2.0
x-content-type-options: nosniff
strict-transport-security: max-age=15724800; includeSubDomains

At the same time all of my local images stored for example in my-local-registry:5000/v2/my-python-image/tags/list and there is no problem for this images.

scalability

Hi,
I see that you are using a local sqlite db. does that mean I can't start several instances of the UI behind a load balancer? Do you have any plans to integrate an external DB?

Home screen does not show New Namespace or reflect new repos without the restart of container

Expected: As and when I push a new image, it should be visible on the UI with the new namespace

eg

podman push localhost:5000/dev/image:v1

it should create a new namespace dev and add image with tag v1

Unless I restart the container with podman-compose restart. It does not show up.

Support showing image details for OCI images in the registry

I'm using the current docker-registry-ui image and Docker registry 2.7.

By default podman builds OCI images. I'm unable to view image details for these images using docker-registry-ui.

To query the manifest from an OCI image in the registry you need to add an Accept header:

fir ~  > curl -k -H "Accept:application/vnd.oci.image.manifest.v1+json" https://fir.local:3005/v2/
arm32v7/builder/manifests/latest
{"schemaVersion":2,"config":{"mediaType":"application/vnd.oci.image.config.v1+json","digest":"sha256:2c81c9601fbaed4945e96b93c9d22417f869bba3be1758dd1e51bba1eda42ae0","size":1119},"layers":[{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","digest":"sha256:a4108b69c3f2a06c303ddfd007e1a739e368de5a337e7dc3c298ba3e454cfb08","size":2455704},{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","digest":"sha256:6e9e5cf384fc0ebb51c5ed1f3374762f8a28cfa5c6ee4e9517b29b89ed0ef6be","size":124872615}]}

Workaround is to build the image in docker form: podman --format docker

default namespace

Hi! can I change load default namespace "library" to another custom?