![\"stefan1\"](\"http:\/\/www.sonatype.org\/nexus\/content\/uploads\/2017\/03\/stefan1.png\")
<\/p>\nThis article shows how you can set up a Docker Private Registry with authentication and SSL using Nexus Repository OSS.<\/p>\n
Nexus Repository OSS is a universal repository manager with support for all major package formats and types. It\u2019s a free solution for storing and sharing Docker images and other components like NuGet or NPM packages across the deployment pipeline while keeping your proprietary and third-party images private and secure.<\/p>\n
<\/p>\n
I am using an Ubuntu Server 16.04 and Docker 1.12 to host the Nexus Repository and NGINX containers.<\/p>\n
First you have to build your own Nexus 3 docker image and expose port 8081 and 5000. Nexus management UI will run on 8081 while Docker Registry will run on 5000. This Docker image can be found on Docker Hub at stefanprodan\/nexus<\/a>.<\/p>\n Create a directory named nexus and add a Dockerfile with the following content:<\/p>\n Next you need to create a dedicated docker network for your registry:<\/p>\n Now you can build the nexus image and run the nexus container:<\/p>\n Replace Create a directory named nginx and add a Dockerfile with the following content:<\/p>\n In the same directory create the nginx.conf file with the following content:<\/p>\n Replace Build and run the NGINX container:<\/p>\n Now you can access the Nexus UI by navigation to your nexus sub-domain. The default credentials are Navigate to the repository administration page and create a new repository by selecting the docker (hosted)<\/em><\/strong> recipe. In the repository connectors section, check Create an HTTP connector at specified port<\/em><\/strong> and insert 5000<\/em><\/strong> as the port value. For a detailed walkthrough check the nexus documentation on Docker Registry<\/a>.<\/p>\n At this point, the Docker Registry is up and running, but you can\u2019t access it from a docker client because Docker requires the registry to run on SSL.<\/p>\n\nFROM alpine:3.4\n\nENV NEXUS_VERSION<\/span>=<\/span>\"3.0.2-02\"<\/span> \\<\/span>\n NEXUS_DATA<\/span>=<\/span>\"\/nexus-data\"<\/span> \\<\/span>\n JAVA_MIN_MEM<\/span>=<\/span>\"1200M\"<\/span> \\<\/span>\n JAVA_MAX_MEM<\/span>=<\/span>\"1200M\"<\/span> \\<\/span>\n JKS_PASSWORD<\/span>=<\/span>\"changeit\"<\/span>\n\nRUN set<\/span> -x \\<\/span>\n &&<\/span> apk --no-cache add \\<\/span>\n openjdk8-jre-base \\<\/span>\n openssl \\<\/span>\n su-exec \\<\/span>\n &&<\/span> mkdir \"\/opt\"<\/span> \\<\/span>\n &&<\/span> wget -qO - \"https:\/\/download.sonatype.com\/nexus\/3\/nexus-<\/span>${<\/span>NEXUS_VERSION<\/span>}<\/span>-unix.tar.gz\"<\/span> \\<\/span>\n | tar -zxC \"\/opt\"<\/span> \\<\/span>\n &&<\/span> adduser -S -h ${<\/span>NEXUS_DATA<\/span>}<\/span> nexus \\<\/span>\n\t&&<\/span> sed \\<\/span>\n\t\t-e \"s|-Xms1200M|-Xms<\/span>${<\/span>JAVA_MIN_MEM<\/span>}<\/span>|g\"<\/span> \\<\/span>\n\t\t-e \"s|-Xmx1200M|-Xmx<\/span>${<\/span>JAVA_MAX_MEM<\/span>}<\/span>|g\"<\/span> \\<\/span>\n\t\t-e \"s|karaf.home=.|karaf.home=\/opt\/nexus-<\/span>${<\/span>NEXUS_VERSION<\/span>}<\/span>|g\"<\/span> \\<\/span>\n\t\t-e \"s|karaf.base=.|karaf.base=\/opt\/nexus-<\/span>${<\/span>NEXUS_VERSION<\/span>}<\/span>|g\"<\/span> \\<\/span>\n\t\t-e \"s|karaf.etc=etc|karaf.etc=\/opt\/nexus-<\/span>${<\/span>NEXUS_VERSION<\/span>}<\/span>\/etc|g\"<\/span> \\<\/span>\n\t\t-e \"s|java.util.logging.config.file=etc|java.util.logging.config.file=\/opt\/nexus-<\/span>${<\/span>NEXUS_VERSION<\/span>}<\/span>\/etc|g\"<\/span> \\<\/span>\n\t\t-e \"s|karaf.data=data|karaf.data=<\/span>${<\/span>NEXUS_DATA<\/span>}<\/span>|g\"<\/span> \\<\/span>\n\t\t-e \"s|java.io.tmpdir=data\/tmp|java.io.tmpdir=<\/span>${<\/span>NEXUS_DATA<\/span>}<\/span>\/tmp|g\"<\/span> \\<\/span>\n\t\t-i \"\/opt\/nexus-<\/span>${<\/span>NEXUS_VERSION<\/span>}<\/span>\/bin\/nexus.vmoptions\"<\/span> \\<\/span>\n\t&&<\/span> mkdir -p \"<\/span>${<\/span>NEXUS_DATA<\/span>}<\/span>\"<\/span> \\<\/span>\n\t&&<\/span> chown -R nexus \"<\/span>${<\/span>NEXUS_DATA<\/span>}<\/span>\"<\/span>\n\nEXPOSE 8081 5000\n\nWORKDIR \"\/opt\/nexus-<\/span>${<\/span>NEXUS_VERSION<\/span>}<\/span>\"<\/span>\n\nVOLUME ${<\/span>NEXUS_DATA<\/span>}<\/span>\n\nCMD [<\/span>\"su-exec\"<\/span>, \"nexus\"<\/span>, \"bin\/nexus\"<\/span>, \"run\"<\/span>]<\/span>\n<\/code><\/pre>\n<\/div>\n\ndocker network create intranet\n<\/code><\/pre>\n<\/div>\n\ndocker build -t nexus-img .\n\ndocker run -d --name nexus \\<\/span>\n -v \/path\/to\/nexus-data:\/nexus-data \\<\/span>\n --restart unless-stopped \\<\/span>\n --network intranet nexus-img\n<\/code><\/pre>\n<\/div>\n\/path\/to\/nexus-data<\/code> with your own location.<\/p>\nRunning NGINX as reverse proxy for Nexus<\/h3>\n
\nFROM nginx\nCOPY .\/nginx.conf \/etc\/nginx\/nginx.conf\n<\/code><\/pre>\n<\/div>\n\nworker_processes 2;\n\nevents {<\/span>\n\tworker_connections 1024;\n}<\/span>\n\nhttp {<\/span>\n\terror_log \/var\/log\/nginx\/error.log warn;\n\taccess_log \/dev\/null;\n\tproxy_intercept_errors off;\n\tproxy_send_timeout 120;\n\tproxy_read_timeout 300;\n\n\tupstream nexus {<\/span>\n server nexus:8081;\n\t}<\/span>\n\n\tupstream registry {<\/span>\n server nexus:5000;\n\t}<\/span>\n\n\tserver {<\/span>\n listen 80;\n server_name nexus.demo.com;\n\n keepalive_timeout 5 5;\n proxy_buffering off;\n\n # allow large uploads<\/span>\n client_max_body_size 1G;\n\n location \/ {<\/span>\n\t\t# redirect to docker registry<\/span>\n\t\tif<\/span> (<\/span>$http_user_agent<\/span> ~ docker )<\/span> {<\/span>\n\t\t\tproxy_pass http:\/\/registry;\n\t\t}<\/span>\n\t\tproxy_pass http:\/\/nexus;\n\t\tproxy_set_header Host $host<\/span>;\n\t\tproxy_set_header X-Real-IP $remote_addr<\/span>;\n\t\tproxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for<\/span>;\n }<\/span>\n }<\/span>\n}<\/span>\n\n<\/code><\/pre>\n<\/div>\nnexus.demo.com<\/code> with your own domain. The NGINX server detects if a call is made by the docker client, based on user agent, and redirects that call to the Docker Registry.<\/p>\n\ndocker build -t nginx-img .\n\ndocker run -d --publish 80:80 --name nginx \\<\/span>\n --restart unless-stopped \\<\/span>\n --network intranet \\<\/span>\n nginx-img\n<\/code><\/pre>\n<\/div>\nadmin<\/code> \/ admin123<\/code>, you should change them before proceeding with the setup. Nexus can be configured to support static or dynamic user and group definitions and can authenticate users against LDAP or Active Directory.<\/p>\n