builds-docker-credentials-private-registries.adoc

Using Docker credentials for private registries

You can supply builds with a .docker/config.json file with valid credentials for private container registries. This allows you to push the output image into a private container image registry or pull a builder image from the private container image registry that requires authentication.

Note	For the {product-title} container image registry, this is not required because secrets are generated automatically for you by {product-title}.

The .docker/config.json file is found in your home directory by default and has the following format:

auths:
  https://index.docker.io/v1/: (1)
    auth: "YWRfbGzhcGU6R2labnRib21ifTE=" (2)
    email: "user@example.com" (3)

1. URL of the registry.

2. Encrypted password.

3. Email address for the login.

You can define multiple container image registry entries in this file. Alternatively, you can also add authentication entries to this file by running the docker login command. The file will be created if it does not exist.

Kubernetes provides Secret objects, which can be used to store configuration and passwords.

Prerequisites

• .docker/config.json file

Procedure

1. Create the secret from your local .docker/config.json file:

   $ oc create secret generic dockerhub \
       --from-file=.dockerconfigjson=<path/to/.docker/config.json> \
       --type=kubernetes.io/dockerconfigjson

   This generates a JSON specification of the secret named dockerhub and creates the object.

2. Once the secret is created, add it to the builder service account. Each build is run with the builder role, so you must give it access your secret with the following command:

   $ oc secrets link builder dockerhub

3. Add a pushSecret field into the output section of the BuildConfig and set it to the name of the secret that you created, which in the above example is dockerhub:

   spec:
     output:
       to:
         kind: "DockerImage"
         name: "private.registry.com/org/private-image:latest"
       pushSecret:
         name: "dockerhub"

   You can use the oc set build-secret command to set the push secret on the build configuration:

   $ oc set build-secret --push bc/sample-build dockerhub

4. Pull the builder container image from a private container image registry by specifying the pullSecret field, which is part of the build strategy definition:

   strategy:
     sourceStrategy:
       from:
         kind: "DockerImage"
         name: "docker.io/user/private_repository"
       pullSecret:
         name: "dockerhub"

   You can use the oc set build-secret command to set the pull secret on the build configuration:

   $ oc set build-secret --pull bc/sample-build dockerhub

Note	This example uses pullSecret in a Source build, but it is also applicable in Docker and Custom builds.