Allow one private registry with docker

Question

I need to block all registries and allow only one private registry for docker to pull images from , how can that be done natively in docker.

Answer 1

Just found in redhat docs:

This can be done on docker daemon config:

/etc/sysconfig/docker

BLOCK_REGISTRY='--block-registry=all'
ADD_REGISTRY='--add-registry=registry.access.redhat.com'

and then do:

systemctl restart docker

Answer 2

Using the RedHat options will not work on the upstream Docker CE or EE engine, RedHat had forked the docker engine and added their own features that are incompatible. You'll also find that /etc/sysconfig/docker is a RedHat only configuration file, designed to work with their version of the startup scripts. And I don't believe RedHat supports this old fork either, instead preferring their own podman and crio runtimes.

A hard limit on registry servers is not currently supported in the Linux Docker engine. The standard way to implement this for servers is with firewall rules on outbound connections, but that needs to only permit outbound connections to a known allow list. You still need to ensure that users don't import images from a tar file, or rebuild the otherwise blocked images from scratch (for example, all of official images on Docker Hub have the source available to rebuild them).

With Docker Desktop, the ability to restrict what registries a user can pull from has been added in their paid business tier with their image access management.

Previously I might have suggested using Notary and Docker Content Trust to ensure you only run trusted images, but that tooling has a variety of known issue, including the use of TOFU (trust on first use) that allows any image from a repo that hasn't been seen before to be signed by anyone and trusted to run. There are a few attempts to replace this, and the current leader is sigstore/cosign, but that isn't integrated directly into the docker engine. If you run in Kubernetes, this would be configured in your admission controller, like Gatekeeper or Kyverno.