This article will present a simple example to create a ghcr.io remote repository. The examples and screenshots provided are from Artifactory 7.41.7.
Set Up
To start things off we will create a new Docker Remote Repository in Artifactory.
We will use https://ghcr.io/ as the URL. The User Name and Password / Access Token is the Personal access token (PAT) generated from Github that will have access to any images needed from this repository. If you don’t wish to input any credentials you may leave the User Name and Password / Access Token fields blank.
Note that with credentials, the test button will result in a 403 or 401 response from Github. This is expected and can be ignored.
Testing
Now let us go through a test to see if we can resolve from ghcr.io.
In this test we will be attempting to resolve a private ghcr.io image. I had previously uploaded a docker image, hello-test:1.0, to ghcr.io
For this test, I will be first trying to access this private image anonymously (without credentials). To do this I have removed the User Name and Password / Access Token section in the Remote Repository configuration that I had previously added in the Set Up section.
First, perform a docker login to the Artifactory instance. <ART> in this case is the Artifactory URL to reach Artifactory for example “docker.arti.local”. Artifactory, in this case, is using the default Repository Path method so the following docker commands are formatted accordingly.
$ docker login <ART> -uartifactory_user
Password:
Login Succeeded
Next, I try to pull the private docker image.
$ docker pull <ART>/ghcr-remote/derekscp/hello-test:1.0
Error response from daemon: manifest for <ART>/ghcr-remote/derekscp/hello-test:1.0 not found: manifest unknown: The named manifest is not known to the registry.
We can see from this that Artifactory was not able to find this image.
In the artifactory-request-out.log (which is the log file that contains outgoing requests to upstream remote repositories) we can see that our remote repository, ghcr-remote, is reaching out but getting a 401.
2022-08-24T18:19:24.852Z||ghcr-remote||GET|https://ghcr.io/|301|0|0|114
2022-08-24T18:19:24.961Z||ghcr-remote||GET|/features/packages|200|0|0|109
2022-08-24T18:19:25.118Z|441c356bf21512c2|ghcr-remote||GET|https://ghcr.io/token?scope=repository:derekscp/hello-test:pull&service=ghcr.io|401|0|73|199
So now we will re-add the Github PAT as shown in the Set Up section, which has access to this private image.
Note that this repository will need the “Enable Token Authentication” setting to be enabled in Artifactory. By default this option is enabled by default but if it is not you will see HEAD requests in the artifactory-request-out logs show a 401.
i.e.
…|HEAD|https://ghcr.io/v2/derekscp/hello-test/manifests/1.0|401|...
To prevent this make sure that this setting is enabled in the Artifactory remote repository.
We then try another pull:
$ docker pull <ART>/ghcr-remote/derekscp/hello-test:1.0
1.0: Pulling from ghcr-remote/derekscp/hello-test
Digest: sha256:f54a58bc1aac5ea1a25d796ae155dc228b3f0e11d046ae276b39c4bf2f13d8c4
Status: Downloaded newer image for <ART>/ghcr-remote/derekscp/hello-test:1.0
<ART>/ghcr-remote/derekscp/hello-test:1.0
We can now see that it was successful. Additionally, in the artifactory-request-out logs, we see successful 200 requests.
2022-08-24T18:35:02.992Z|701fe56137172a50|ghcr-remote|ghcrtokendemo|GET|https://ghcr.io/token?scope=repository:derekscp/hello-test:pull&service=ghcr.io|200|0|69|231
2022-08-24T18:35:03.303Z|701fe56137172a50|ghcr-remote|ghcrtokendemo|HEAD|https://ghcr.io/v2/derekscp/hello-test/manifests/1.0|200|0|525|771
2022-08-24T18:36:07.228Z|45df5f2f8a8985b2|ghcr-remote|ghcrtokendemo|GET|https://ghcr.io/v2/derekscp/hello-test/manifests/1.0|200|0|525|387
Note
If you are still not seeing a successful pull of the docker image, make sure your Github PAT has enough permissions.
I.e.
If it has to do with permissions you may see the outgoing request in artifactory-request-out logs return a 403.
2022-08-24T18:30:18.458Z|56c842492d9bfb53|ghcr-remote|ghcrtokendemo|GET|https://ghcr.io/token?scope=repository:derekscp/hello-test:pull&service=ghcr.io|200|0|69|652
2022-08-24T18:30:18.786Z|56c842492d9bfb53|ghcr-remote|ghcrtokendemo|HEAD|https://ghcr.io/v2/derekscp/hello-test/manifests/1.0|403|0|86|1568