- [Instructor] Up to this point,
I've mentioned having your own Docker Registry
quite a few times, and let's explore that
in a little more depth.
This is your anchor point.
It's the place that ties your architecture together,
so it's an important decision to make,
and choose one that fits your needs.
There is no central correct place to store
your registries because everyone's world
is a bit different.
This is the piece that connects all your bits together,
and all of the stages of your build pipelines
will put things here or take things out,
and hopefully having a central place to store
all of these things will give you some peace of mind
in building out your systems.
So where should you store your Docker containers?
You can take a traditional host, a computer,
and install the Docker Registry on it.
Store your containers there.
They're under your control.
You control it.
You'll know if it's down, and you can fix it.
You can put it on an existing service
maybe within your organization.
Perhaps you have a Nexus server,
and it's already running this.
You could go ahead and use it.
You could use one provided by a cloud provider.
If you're an AWS customer,
you already have ECS, which includes a registry,
so you could use that.
You can also just hire the company that built Docker.
They provide a service called Docker Hub,
which is an excellent option.
So let's explore the traditional approach.
You can take an existing server you have.
You can head on over to docs.dockerregistry.com/registry
and follow the instructions here to install this program
on your own server and have tight control
over where your images and your data is stored.
You can use an on-premise hosted service.
You may already have it running.
It may already use an existing security model
configured by your security team.
It takes a single point of failure,
which has an interesting side effect that
if this was once a build-time dependency tool
for your organization, you need this thing to be up
in order to build your software but not to run it.
If you start using it in a new way,
then you turn a build-time dependency
into a run-time dependency,
because if the service is down, then you can't start images.
Be aware when you add new responsibilities
to existing services.
You can use Docker Hub, a fully hosted version
of the Docker Registry provided by the people
who brought you Docker.
Just head on over to hub.docker.com,
make an account or sign in,
and you'll get the login instructions
and be ready to go.
I've mentioned using Amazon's hosted registry a few times,
so now let's go ahead and set that up
on our Jenkins instance so that it can push and pull
images from our own registry.
The first step is going to be to head on over
to the IAM service, the Identity Access Management,
and create a role that will give the Docker instance
permission to read these registries.
One nice thing about the ECS registries
is that they play very nicely with the whole
Docker security model, which can bring a lot
of peace of mind.
So we're going to want to head over to service,
IAM, roles, then create role.
Down here in this list, find the EC2 service,
then click EC2 again to allow EC2 instances
to call AWS services on your behalf,
which is what we're looking for here.
Click permissions.
Now in the search box, enter registry.
Okay, we want to add Amazon EC2 Container Registry
Power User to our Jenkins instance,
so we're going to select that, review,
give our role a name.
Let's call it Jenkins.
And then click create role.
Okay, now that we've got a role,
we need to allow Jenkins to use it.
I went over to the EC2 service, click on instances.
I found my Jenkins instance.
Now I'm going to select the box next to it.
Choose actions, instance settings,
and attach or replace IAM role.
And select the Jenkins role and click apply.
And now if we scroll down,
we can see that our instance is in the Jenkins role.
So the next step is to make ourselves a test registry.
Heading over to the service, the ECS service.
If this is your first time going to the ECS service,
you may see an intro video.
Just click past it.
Go down here and click cancel
to get out of the intro wizard,
and then you'll get to the standard page for the service.
Click on repositories,
then if you haven't used the service before,
click the get started button.
If you have used the service before,
click the new repository button,
and let's call our test repository hello world.
Okay, next step.
Now, this page here is a bunch of useful information
that we're going to use in the next step.
So leave this sitting here,
and head on over to Docker.
Let's go back to that project from the previous video,
the Docker test project,
and let's change it to use the shared registry.
So click on configure.
Under build actions, the first thing we're going to want to do
is after it runs the hello world example,
let's have it log in to our registry.
The way the ECR get login command works
is you run this command,
and it prints out a Docker command
that you then run to actually log in.
So it's a two-step process.
So we're going to have it print out that command,
and then we're going to use shell redirection
to save the command into a file
right there in the Jenkins job.
Then we're going to interpret that file
as a command typed into the terminal
by using the source command.
The source command causes a shell to interpret a file
as if it had been typed in from the keyboard.
Then let's get to the fun part.
Let's tag the hello world image we just used
and save our own copy into our shared registry.
So we're going to run Docker tag hello world latest,
which is what we ran on the first line.
We're going to give it a new name, an additional name.
This name is our account ID, a bunch of stuff,
and I'm totally going to make it match
the current example.
There we are, and our registry name at the end here.
Colon latest to give it the latest tag.
Now where did that come from?
That's why I asked you to leave this terminal open.
Right down here on this page,
it gave you an example of the command here,
so that's where I got it from.
You don't have to remember it.
And now that we've applied the tag,
we can go ahead and run Docker push,
and then that same tag.
And let's go ahead and save this
and see if it runs.
Build now,
okay, and it worked.
Let's take a look at its output.
So we'll see that it ran the hello world Docker
just as we saw before,
and then the Docker log in command
printed out this command.
Docker login dash U, AWS dash P, enormous token,
and then it ran that command,
which produced login succeeded.
Here's our tag command where we added the tag
to the image, is where we pushed that command
to the registry.
We can see that it prepared it.
It pushed it, and then success.
So now you have a Jenkins instance
that can push and pull from your own private registry.