Login to docker registry located in Gitlab

Question

I created a docker registry and want to connect it with GitLab. I followed this documentation https://docs.gitlab.com/ce/user/project/container_registry.html. After that I tried to login to docker, but I received 401 or Access denied, do you know how to fix this ?

docker login url
Username: gitlab-ci-token
Password: 
https://<url>/v2/: unauthorized: HTTP Basic: Access denied

docker login <url>
Username: knikolov
Password: 
https://<url>/v2/: unauthorized: HTTP Basic: Access denied

docker login <url>
Username: knikolov
Password: 
Error response from daemon: login attempt to https://<url>/v2/ failed with status: 401 Unauthorized

production.log

Started POST "/api/v4/jobs/request" for 172.17.0.1 at 2017-06-22 14:42:51 +0000
Started POST "/api/v4/jobs/request" for 172.17.0.1 at 2017-06-22 14:42:54 +0000
Started POST "/api/v4/jobs/request" for 172.17.0.1 at 2017-06-22 14:42:57 +0000
Started POST "/api/v4/jobs/request" for 172.17.0.1 at 2017-06-22 14:43:00 +0000
Started POST "/api/v4/jobs/request" for 172.17.0.1 at 2017-06-22 14:43:03 +0000
Started POST "/api/v4/jobs/request" for 172.17.0.1 at 2017-06-22 14:43:06 +0000
Started POST "/api/v4/jobs/request" for 172.17.0.1 at 2017-06-22 14:43:09 +0000
Started POST "/api/v4/jobs/request" for 172.17.0.1 at 2017-06-22 14:43:12 +0000
Started POST "/api/v4/jobs/request" for 172.17.0.1 at 2017-06-22 14:43:15 +0000
Started POST "/api/v4/jobs/request" for 172.17.0.1 at 2017-06-22 14:43:18 +0000
Started GET "/jwt/auth?account=knikolov&client_id=docker&offline_token=true&service=container_registry" for 172.17.0.1 at 2017-06-22 14:43:19 +0000
Processing by JwtController#auth as HTML
Parameters: {"account"=>"knikolov", "client_id"=>"docker", "offline_token"=>"true", "service"=>"container_registry"}
Completed 200 OK in 191ms (Views: 0.5ms | ActiveRecord: 5.7ms)
Started GET "/admin/logs" for 172.17.0.1 at 2017-06-22 14:43:21 +0000
Processing by Admin::LogsController#show as HTML

Form the registry log I received:

registry_1  | time="2017-06-25T17:34:31Z" level=warning msg="error authorizing context: authorization token required" go.version=go1.7.3 http.request.host=<url> http.request.id=e088c13e-aa4c-4701-af26-29e12874519b http.request.method=GET http.request.remoteaddr=37.59.24.105 http.request.uri="/v2/" http.request.useragent="docker/17.03.1-ce go/go1.7.5 git-commit/c6d412e kernel/4.4.0-81-generic os/linux arch/amd64 UpstreamClient(Docker-Client/17.03.1-ce \\(linux\\))" instance.id=c8d463e0-cf04-48f5-8daa-d096b4e75494 version=v2.6.1 
registry_1  | 172.17.0.1 - - [25/Jun/2017:17:34:31 +0000] "GET /v2/ HTTP/1.0" 401 87 "" "docker/17.03.1-ce go/go1.7.5 git-commit/c6d412e kernel/4.4.0-81-generic os/linux arch/amd64 UpstreamClient(Docker-Client/17.03.1-ce \\(linux\\))"

registry_1  | time="2017-06-25T17:34:32Z" level=info msg="token from untrusted issuer: \"omnibus-gitlab-issuer\"" 

registry_1  | time="2017-06-25T17:34:32Z" level=warning msg="error authorizing context: invalid token" go.version=go1.7.3 http.request.host=<url> http.request.id=ff0d15e4-3198-4d69-910b-50bc27dd02f2 http.request.method=GET http.request.remoteaddr=37.59.24.105 http.request.uri="/v2/" http.request.useragent="docker/17.03.1-ce go/go1.7.5 git-commit/c6d412e kernel/4.4.0-81-generic os/linux arch/amd64 UpstreamClient(Docker-Client/17.03.1-ce \\(linux\\))" instance.id=c8d463e0-cf04-48f5-8daa-d096b4e75494 version=v2.6.1 
registry_1  | 172.17.0.1 - - [25/Jun/2017:17:34:32 +0000] "GET /v2/ HTTP/1.0" 401 87 "" "docker/17.03.1-ce go/go1.7.5 git-commit/c6d412e kernel/4.4.0-81-generic os/linux arch/amd64 UpstreamClient(Docker-Client/17.03.1-ce \\(linux\\))"

this is my config for my registry:

version: 0.1
log:
  fields:
    service: registry
storage:
  cache:
    blobdescriptor: inmemory
  filesystem:
    rootdirectory: /var/lib/registry
  delete:
    enabled: true
http:
  addr: :5000
  headers:
    X-Content-Type-Options: [nosniff]
health:
  storagedriver:
    enabled: true
    interval: 10s
    threshold: 3
auth:
  token:
    realm: https://<url>/jwt/auth
    service: container_registry
    issuer: gitlab-issuer
    rootcertbundle: /certs/registry.crt

docker-compose.yml

registry:
  restart: always
  image: registry:2
  ports:
    - 127.0.0.1:5000:5000
  environment:
    - REGISTRY_STORAGE_DELETE_ENABLED=true
  volumes:
    - ./data:/var/lib/registry
    - ./certs:/certs
    - ./config.yml:/etc/docker/registry/config.yml

Gitlab docker-compose.yml

web:
  image: 'gitlab/gitlab-ce:latest'
  restart: always
  hostname: '<gitlab_url>'
  container_name: gitlab
  environment:
    GITLAB_OMNIBUS_CONFIG: |
      external_url '<gitlab_url>'
      gitlab_rails['gitlab_shell_ssh_port'] = 2224
      registry_external_url '<docker-registry_url>'

      gitlab_rails['smtp_enable'] = true
      gitlab_rails['smtp_address'] = "172.17.0.1"
      gitlab_rails['smtp_domain'] = "<smtp_domain>"
      gitlab_rails['gitlab_email_from'] = '<gitlab_email_from>'
      gitlab_rails['smtp_enable_starttls_auto'] = false

      gitlab_rails['registry_enabled'] = true

      registry_nginx['ssl_certificate'] = '/etc/gitlab/ssl/docker.registry.crt'
      registry_nginx['ssl_certificate_key'] = '/etc/gitlab/ssl/docker.registry.key'

      registry_nginx['proxy_set_headers'] = {
          "Host" => "<dokcer-registry_url>" 
      }

      nginx['listen_port'] = 80
      nginx['listen_https'] = false
      nginx['proxy_set_headers'] = {
          "X-Forwarded-Proto" => "https",
          "X-Forwarded-Ssl" => "on"
      }
  ports:
    - '127.0.0.1:5432:80'
    - '2224:22'
  volumes:
    - '/home/gitlab/gitlab-ce/config:/etc/gitlab'
    - '/home/gitlab/gitlab-ce/logs:/var/log/gitlab'
    - '/home/gitlab/gitlab-ce/data:/var/opt/gitlab'
    - '/home/docker-registry/data:/var/opt/gitlab/gitlab-rails/shared/registry'

Answer 1

Make sure the .crt file and .key file exists on the path specified here in gitlab.rb if not make the changes and restart gitlab with - sudo gitlab-ctl restart

external_url 'https://myrepo.xyz.com'
nginx['redirect_http_to_https'] = true
registry_external_url 'https://registry.xyz.com'
registry_nginx['ssl_certificate'] = "/etc/gitlab/ssl/registry.xyz.com.crt"
registry_nginx['ssl_certificate_key'] = "/etc/gitlab/ssl/registry.xyz.com.key"

More details available at - Appychip

Answer 2

It seems like you are not using the same RSA keypair for your Gitlab registry backend and your Docker setup.

Check your gitlab_rails['registry_key_path'] setting in Gitlab.rb and consult this very detailed guide.

https://m42.sh/gitlab-registry.html (unfortunately offline, backup copy here: https://github.com/ipernet/gitlab-docs/blob/master/gitlab-registry.md)