Using Docker V1

Artifactory can only be used with Docker through a reverse proxy due to the following limitations of the Docker client:

For Artifactory to work with Docker, the preferred web server is NGINX v1.3.9 and above configured as a reverse proxy.

For other supported web servers, please refer to Alternative Proxy Servers.

Below is a sample configuration for NGINX which configures SSL on port 443 to a specific local repository in Artifactory (named docker-local) on a server called artprod.company.com.

 [...]
  
http {
     
    ##
    # Basic Settings
    ##
    [...]
  
    server {
        listen 443;
        server_name artprod.company.com;
 
        ssl on;
        ssl_certificate /etc/ssl/certs/artprod.company.com.crt;
        ssl_certificate_key /etc/ssl/private/artprod.company.com.key;
 
        access_log /var/log/nginx/artprod.company.com.access.log;
        error_log /var/log/nginx/artprod.company.com.error.log;
 
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Original-URI $request_uri;
        proxy_read_timeout 900;
 
        client_max_body_size 0; # disable any limits to avoid HTTP 413 for large image uploads
 
        # required to avoid HTTP 411: see Issue #1486 (https://github.com/docker/docker/issues/1486)
        chunked_transfer_encoding on;
 
        location /v1 {
            proxy_pass http://artprod.company.com:8081/artifactory/api/docker/docker-local/v1;
        }
    }
}

This is done in the same way as when configuring a local repository to work with Docker V2, however, in the Docker Settings section, you should make sure to select V1 as the Docker API version.

When using Artifactory with Docker V1, you need to set your credentials manually by adding the following section to your ~/.docker/config.json file.

~/.docker/config.json

{
        "auths" :{
                "https://artprod.company.com" : {
                        "auth": "<USERNAME>:<PASSWORD> (converted to base 64)",
                                "email": "youremail@email.com"
                },
                "https://artdev.company.com" : {
                        "auth": "<USERNAME>:<PASSWORD> (converted to base 64)",
                                "email": "youremail@email.com"
                }
        }
} 

Pushing and pulling images when using Docker V1 is done in the same way as when using Docker V2.

Once you have completed the above setup you should be able to use the Docker client to transparently push images to and pull them from Docker repositories in Artifactory. You can see this in action in the screencast below.

Artifactory lets you view the complete images tree for a specific image directly from the UI in a similar way to what you would get from the docker images --tree command.

In the Artifacts module Tree Browser, drill down to select the image you want to inspect. The metadata is displayed in the Docker Ancestry tab.

In the Artifacts module Tree Browser, drill down to select image you want to inspect. The metadata is displayed in the Docker Info tab.

In addition to other properties related to Docker repositories, you can also search for repositories using a property called docker.repoName, which represents the repository name (e.g., library/ubuntu).

Promoting Docker images with Docker V1 is done in exactly the same way as when Promoting Images with Docker V2.

From Docker version 1.3.1, you can use self-signed SSL certificates with docker push/pull commands, however for this to work, you need to specify the --insecure-registry daemon flag for each insecure registry.

For full details please refer to the Docker documentation.

For example, if you are running Docker as a service, edit the /etc/default/docker file, and append the --insecure-registry flag with your registry URL to the DOCKER_OPTS variable as in the following example:

Edit the DOCKER_OPTS variable

DOCKER_OPTS="-H unix:///var/run/docker.sock --insecure-registry artprod.company.com"

For this to take effect, you need to restart the Docker service.

If you are using Boot2Docker, please refer to the Boot2Docker documentation for Insecure Registry.

If you do not make the required modifications to the --insecure-registry daemon flag, you should get the following error:

Error message

Error: Invalid registry endpoint https://artprod.company.com/v1/: Get https://artprod.company.com/v1/_ping: x509: certificate signed by unknown authority.

In addition to NGINX, you can setup Artifactory to work with Docker using Apache.

<VirtualHost *:443>
  ServerName artprod.company.com 

  ErrorLog ${APACHE_LOG_DIR}/error.log
  CustomLog ${APACHE_LOG_DIR}/access.log combined

  SSLEngine on
  SSLCertificateFile      /etc/ssl/certs/artprod.company.com.pem
  SSLCertificateKeyFile   /etc/ssl/private/artprod.company.com.key

  ProxyRequests off
  ProxyPreserveHost on

  ProxyPass         / http://artprod.company.com:8080/artifactory/api/docker/docker-local/
  ProxyPassReverse  / http://artprod.company.com:8080/artifactory/api/docker/docker-local/
</VirtualHost>

If you want to use multiple repositories, you need to copy the NGINX configuration and bind different ports to each local repository in Artifactory.

When binding a port other than 443, note that the configuration for the proxy header must be appended with the port number on the proxy_set_header line.

For example, for a server running on port 444 you should write proxy_set_header Host $host:444.

When accessing a Docker repository through Artifactory, the repository URL must be prefixed with api/docker in the path.

You can copy the full URL from the UI using Set Me Up when the repository is selected in the Tree Browser.

For example, if you are using Artifactory standalone or as a local service, you would access your Docker repositories using the following URL:

http://localhost:8081/artifactory/api/docker/<repository key>

Also, the domain of your Docker repository must be expressed as an explicit IP address. The only exception is when working locally, you can use the localhost domain name as the proxy pass.