OpenShift: Can I set up a build that copies a docker image from an imagestream to an external docker repository?

Question

We are trying to set up an OpenShift flow as close to the defaults as possible, without having to use Jenkins.

So far I have managed to adapt a s2i-generated Dockerfile to our needs (to get the benefits of the s2i images) and set up a simple "oc new-app" pipeline which creates a build following a git repository pushing the generated docker image to an image stream and a deployment triggered by the image stream update pushing to a default pod. This works well.

Now we want to additionally have this docker image pushed to an external docker repository (the RED HAT CONTAINER REGISTRY known by OpenShift) and I would essentially like to keep the existing flow instead of adapting it to use the external registry instead of the internal.

So, can I set up a "build" or something like it which does nothing but take that image and push it to the docker registry? How do I set it up using the oc command?

Answer 1

Would you like to push the image builded by buildConfig to external registry, right ? I think the work flow is like this:Using Docker Credentials for Private Registries.

• Create credential secret

$ oc create secret generic <secret_name> \
    --from-file=.dockerconfigjson=<path/to/.docker/config.json> \
    --type=kubernetes.io/dockerconfigjson

• Link the secret with builder ServiceAccount.

• Configure the build image push target in the buildConfig as follows.

spec:
  output:
    to:
      kind: DockerImage   
      name: external.registry.io/subpath/imagename:latest
    pushSecret:
      name: <secret_name>

I hope it help you.

Answer 2

You can use the skopeo command-line tool to copy container images from one docker registry to another without needing to build the image a second time.

This is an officially supported tool by Red Hat that is part of the new suite of tools (buildah, podman, skopeo, etc) to support running OpenShift and Kubernetes on top of the daemonless cri-o container runtime instead of docker.

Either log in to the source and destination registries via docker login or use the --src-creds and --dest-creds flags.

skopeo copy \
  --src-creds=testuser:testpassword \
  --dest-creds=otheruser:otherpassword \
  docker://myregistrydomain.com:5000/dockerimage:tag \
  docker://mysecondregistrydomain.com:5000/dockerimage:tag