base on A container registry backed by Workers and R2. # Container Registry in Workers This repository contains a container registry implementation in Workers that uses R2. It supports all pushing and pulling workflows. It also supports Username/Password and public key JWT based authentication. ### Deployment You have to install all the dependencies with [pnpm](https://pnpm.io/installation) (other package managers may work, but only pnpm is supported.) ```bash $ pnpm install ``` After installation, there is a few steps to actually deploy the registry into production: 1. Have your own `wrangler` file. ```bash $ cp wrangler.toml.example wrangler.toml ``` 2. Setup the R2 Bucket for this registry ```bash $ npx wrangler --env production r2 bucket create r2-registry ``` Add this to your `wrangler.toml` ``` r2_buckets = [ { binding = "REGISTRY", bucket_name = "r2-registry"} ] ``` 3. Deploy your image registry ```bash $ npx wrangler deploy --env production ``` Your registry should be up and running. It will refuse any requests if you don't setup credentials. ### Adding username password based authentication Set the USERNAME and PASSWORD as secrets with `npx wrangler secret put USERNAME --env production` and `npx wrangler secret put PASSWORD --env production`. ### Adding JWT authentication with public key You can add a base64 encoded JWT public key to verify passwords (or token) that are signed by the private key. `npx wrangler secret put JWT_REGISTRY_TOKENS_PUBLIC_KEY --env production` ### Using with Docker You can use this registry with Docker to push and pull images. Example using `docker push` and `docker pull`: ```bash export REGISTRY_URL=your-url-here # Replace $PASSWORD and $USERNAME with the actual credentials echo $PASSWORD | docker login --username $USERNAME --password-stdin $REGISTRY_URL docker pull ubuntu:latest docker tag ubuntu:latest $REGISTRY_URL/ubuntu:latest docker push $REGISTRY_URL/ubuntu:latest # Check that pulls work docker rmi ubuntu:latest $REGISTRY_URL/ubuntu:latest docker pull $REGISTRY_URL/ubuntu:latest ``` ### Configuring Pull fallback You can configure the R2 registry to fallback to another registry if it doesn't exist in your R2 bucket. It will download from the registry and copy it into the R2 bucket. In the next pull it will be able to pull it directly from R2. This is very useful for migrating from one registry to `serverless-registry`. It supports both Basic and Bearer authentications as explained in the [registry spec](https://distribution.github.io/distribution/spec/auth/token/). In the wrangler.toml file: ``` [env.production.vars] REGISTRIES_JSON = "[{ \"registry\": \"https://url-to-other-registry\", \"password_env\": \"REGISTRY_TOKEN\", \"username\": \"username-to-use\" }]" ``` Set as a secret the registry token of the registry you want to setup pull fallback in. For example [gcr](https://cloud.google.com/artifact-registry/docs/reference/docker-api): ``` cat ./registry-service-credentials.json | base64 | npx wrangler secret put REGISTRY_TOKEN --env production ``` [Github](https://github.com/settings/tokens) for example uses a simple token that you can copy. ``` echo $GITHUB_TOKEN | npx wrangler secret put REGISTRY_TOKEN --env production ``` The trick is always looking for how you would login in Docker for the target registry and setup the credentials. **Never put a registry password/token inside the wrangler.toml, please always use `wrangler secrets put`** ### Known limitations Right now there is some limitations with this container registry. - Pushing with docker is limited to images that have layers of maximum size 500MB. Refer to maximum request body sizes in your Workers plan. - To circumvent that limitation, you can either manually interact with the R2 bucket to upload the layer or take a peek at the `./push` folder for some inspiration on how can you push big layers. - If you use `npx wrangler dev` and push to the R2 registry with docker, the R2 registry will have to buffer the request on the Worker. ## License The project is licensed under the [Apache License](https://opensource.org/licenses/apache-2.0/). ### Contribution See `CONTRIBUTING.md` for contributing to the project. ", Assign "at most 3 tags" to the expected json: {"id":"11696","tags":[]} "only from the tags list I provide: [{"id":77,"name":"3d"},{"id":89,"name":"agent"},{"id":17,"name":"ai"},{"id":54,"name":"algorithm"},{"id":24,"name":"api"},{"id":44,"name":"authentication"},{"id":3,"name":"aws"},{"id":27,"name":"backend"},{"id":60,"name":"benchmark"},{"id":72,"name":"best-practices"},{"id":39,"name":"bitcoin"},{"id":37,"name":"blockchain"},{"id":1,"name":"blog"},{"id":45,"name":"bundler"},{"id":58,"name":"cache"},{"id":21,"name":"chat"},{"id":49,"name":"cicd"},{"id":4,"name":"cli"},{"id":64,"name":"cloud-native"},{"id":48,"name":"cms"},{"id":61,"name":"compiler"},{"id":68,"name":"containerization"},{"id":92,"name":"crm"},{"id":34,"name":"data"},{"id":47,"name":"database"},{"id":8,"name":"declarative-gui "},{"id":9,"name":"deploy-tool"},{"id":53,"name":"desktop-app"},{"id":6,"name":"dev-exp-lib"},{"id":59,"name":"dev-tool"},{"id":13,"name":"ecommerce"},{"id":26,"name":"editor"},{"id":66,"name":"emulator"},{"id":62,"name":"filesystem"},{"id":80,"name":"finance"},{"id":15,"name":"firmware"},{"id":73,"name":"for-fun"},{"id":2,"name":"framework"},{"id":11,"name":"frontend"},{"id":22,"name":"game"},{"id":81,"name":"game-engine "},{"id":23,"name":"graphql"},{"id":84,"name":"gui"},{"id":91,"name":"http"},{"id":5,"name":"http-client"},{"id":51,"name":"iac"},{"id":30,"name":"ide"},{"id":78,"name":"iot"},{"id":40,"name":"json"},{"id":83,"name":"julian"},{"id":38,"name":"k8s"},{"id":31,"name":"language"},{"id":10,"name":"learning-resource"},{"id":33,"name":"lib"},{"id":41,"name":"linter"},{"id":28,"name":"lms"},{"id":16,"name":"logging"},{"id":76,"name":"low-code"},{"id":90,"name":"message-queue"},{"id":42,"name":"mobile-app"},{"id":18,"name":"monitoring"},{"id":36,"name":"networking"},{"id":7,"name":"node-version"},{"id":55,"name":"nosql"},{"id":57,"name":"observability"},{"id":46,"name":"orm"},{"id":52,"name":"os"},{"id":14,"name":"parser"},{"id":74,"name":"react"},{"id":82,"name":"real-time"},{"id":56,"name":"robot"},{"id":65,"name":"runtime"},{"id":32,"name":"sdk"},{"id":71,"name":"search"},{"id":63,"name":"secrets"},{"id":25,"name":"security"},{"id":85,"name":"server"},{"id":86,"name":"serverless"},{"id":70,"name":"storage"},{"id":75,"name":"system-design"},{"id":79,"name":"terminal"},{"id":29,"name":"testing"},{"id":12,"name":"ui"},{"id":50,"name":"ux"},{"id":88,"name":"video"},{"id":20,"name":"web-app"},{"id":35,"name":"web-server"},{"id":43,"name":"webassembly"},{"id":69,"name":"workflow"},{"id":87,"name":"yaml"}]" returns me the "expected json"