Commit e64b0116 authored by Steve Azzopardi's avatar Steve Azzopardi

Emphasis the importance of auth registry

The container registry requires the `auth` config to be set up properly
or users will be able to download images that they are not authorized to
do so.

For example https://gitlab.com/gitlab-org/gitlab-runner/issues/3652
parent d19a6f68
...@@ -71,7 +71,7 @@ A Registry init file is not shipped with GitLab if you install it from source. ...@@ -71,7 +71,7 @@ A Registry init file is not shipped with GitLab if you install it from source.
Hence, [restarting GitLab][restart gitlab] will not restart the Registry should Hence, [restarting GitLab][restart gitlab] will not restart the Registry should
you modify its settings. Read the upstream documentation on how to achieve that. you modify its settings. Read the upstream documentation on how to achieve that.
At the absolute minimum, make sure your [Registry configuration][registry-auth] At the **absolute** minimum, make sure your [Registry configuration][registry-auth]
has `container_registry` as the service and `https://gitlab.example.com/jwt/auth` has `container_registry` as the service and `https://gitlab.example.com/jwt/auth`
as the realm: as the realm:
...@@ -84,6 +84,9 @@ auth: ...@@ -84,6 +84,9 @@ auth:
rootcertbundle: /root/certs/certbundle rootcertbundle: /root/certs/certbundle
``` ```
CAUTION: **Caution:**
If `auth` is not set up, users will be able to pull docker images without authentication.
## Container Registry domain configuration ## Container Registry domain configuration
There are two ways you can configure the Registry's external domain. There are two ways you can configure the Registry's external domain.
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment