Integrate or Interface Docker Registry

[mikehaertl]

I know, this may be completely out of scope for this project. But I still try:

It would be cool if gitea could provide support for a docker registry.

Full integration is probably very unlikely to ever being added. But it would already help if we could interface with a standalone registry running in some container. The core features should be:

• Authentication against shared user base
• Authorization with shared repository permissions
• Simple instructions for how to set up the above

[lunny]

Don't know how to implement a docker registry. It seems some similar with git with lfs.

[mikehaertl]

Well, it's not about implementing the registry itself. That's already done and there's even a docker image for it. Details here: https://docs.docker.com/registry/

But the registry by default doesn't do any authentication/authorization. So the task would be to somehow make it use giteas userbase.

It can't be too difficult, because even the Gitlab guys managed to do this 😛 . There's some documentation here:

https://docs.docker.com/registry/deploying/#more-advanced-authentication

A viable option would probably what they call "delegated authentication".

[lunny]

OK. I see. Maybe you can change the title, it's some confusing! 😄

[mikehaertl]

This could probably be very helpful: https://github.com/cesanta/docker_auth

[bkcsoft]

GitLab manages Authentication and Authorization by tightly coupling it to the main GitLab application itself https://gitlab.com/gitlab-org/gitlab-ce/tree/master/lib/container_registry. Which isn't something that Gitea would wanna do.

However, we do have an API that could be used for checking if a user has access to a certain repo. So writing a standalone daemon (or nginx mod) would be fairly straight forward.

[mikehaertl]

However, we do have an API that could be used for checking if a user has access to a certain repo. So writing a standalone daemon (or nginx mod) would be fairly straight forward.

Sounds good. I'm just not (yet) an expert on nginx modules, so if anyone can provide a simple example or even better a full tutorial on how to set this up this would be very helpful. Maybe it could even be added to the documentation? Could be a nice use case example for what you can do with the API ...

[techknowlogick]

@mikehaertl / @bkcsoft I've used the cesanta registry software mentioned above, and it has the ability to call an external binary to see if a specific user has access to push/pull/etc.. a specific image to/from the docker registry. That software would then need a way to authenticate with Gitea which could be added via PR to that software, it already can authn against GitHub, Google, and others.

[mikehaertl]

Sounds perfect and should not be too hard to implement. We should also open an issue at cesenta then. Maybe leave this open in case we need to add extra permissions to allow/disallow registry access fora
user from gitea?

@bkcsoft / @lunny Is the API documented somewhere? Couldn't find any docs.

[lunny]

visit https://docs.gitea.io and see the top sub menu API

[mikehaertl]

Nice, thanks. So the /repos/{username}/{reponame} API request should do what we want, right? Just want to make sure, that we don't miss anything.

{
  "admin": true,
  "pull": true,
  "push": true
}

[bkcsoft]

@mikehaertl yeah pretty much. Have the binary login as a user, then check if pull: true for authorization 🙂

[mikehaertl]

Hmm, after having a closer look I'm not quite sure, how this would work. I'm not really good at reading Go code, but from looking at the source of cesenta's Authenticator interface, there's also a password involved:

https://github.com/cesanta/docker_auth/blob/master/auth_server/authn/authn.go

This sounds reasonable as usually you have to enter a password when you want to push/pull to/from a private docker registry. OTOH they also provide authentication via Github. Not sure how this works from a user perspective though.

@techknowlogick Could you maybe help clarify, how authentication works via a third party API? Is there a password involved?