Enable use of private Docker images

[asthomasdk]

Please add support for private docker registries in Gitpod - especially the self-hosted version.

We use a lot of private Docker images in our various stacks - also for development.

Not being able to set this up for Gitpod means that we are unable to configure Gitpod workspaces for anything but simple repo editing.

I would expect that for the self-hosted version, using secrets or docker credentials from kubernetes would be a good option to support this.

[svenefftinge]

For self-hosted you can use your own docker registry: https://www.gitpod.io/docs/self-hosted/latest/install/docker-registry/

[asthomasdk]

Can this be set up to use the internal docker registry for workspace image builds (default), but also have access to the external docker registries we have our images in (Docker Hub and Gitlab) ?

I would expect that if the docker credentials in the kubernetes secret are correctly created, it would contain logins to multiple registries and work as long as the correct secret is referenced.

[geropl]

Hi @asthomasdk ,

this is not well (yet) supported in the config surface, but the code should be capable of doing so. Let's see if we can make it work (I assume you have a working config derived from the Gitpod self-hosted repo)

1. gitpod.components.server.defaultBaseImageRegistryWhitelist needs a list of registry domains you want (all) your users to have access to
2. The file registry-auth.json in the secret image-builder-registry-secret (referenced in values/registry.yaml) has to contain the docker secrets for these registries. The file looks like this:

{
	"auths": {
		"gcr.io": {
			"auth": "`+auth+`"
		}
	}
}	

Just add entries for your domains. There are several possibillites for the auth part:

• use a JSON key (for Googles gcr.io) like in the Go script for Google Cloud
• use the ~/.docker/config.json after you did docker login (most likely tight to your personal account!)
  But this depends a bit on the registries you use.

This is not easy for sure or straigth forward and we're working on streamlining things. But it's the best with the state right now.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[akosyakov]

It was requested in the community again: https://community.gitpod.io/t/using-private-docker-images-in-dockerfile/4001/2

[asthomasdk]

Any news or development thoughts on this?

I have managed to work around this by adding envrionment variables through my profile in gitpod. This is hack though, as it is very unsecure.

It would make sense to have custom docker registries that can be setup and managed just like the integrations to external git repos. Having to manually create secrets in kubernetes is a little clumsy ;-)

[asthomasdk]

Hi @asthomasdk ,

this is not well (yet) supported in the config surface, but the code should be capable of doing so. Let's see if we can make it work (I assume you have a working config derived from the Gitpod self-hosted repo)

1. gitpod.components.server.defaultBaseImageRegistryWhitelist needs a list of registry domains you want (all) your users to have access to
2. The file registry-auth.json in the secret image-builder-registry-secret (referenced in values/registry.yaml) has to contain the docker secrets for these registries. The file looks like this:

{
	"auths": {
		"gcr.io": {
			"auth": "`+auth+`"
		}
	}
}	

Just add entries for your domains. There are several possibillites for the auth part:

• use a JSON key (for Googles gcr.io) like in the Go script for Google Cloud
• use the ~/.docker/config.json after you did docker login (most likely tight to your personal account!)
  But this depends a bit on the registries you use.

This is not easy for sure or straigth forward and we're working on streamlining things. But it's the best with the state right now.

Reading this again - does that mean that if I have the image-builder-registry-secret correctkly created, that this will be used generally by gitpod to access external registries? If that is the case, then it could mean that I can get references in my .gitpod.yml to a private image to work. Right now this has to be a public image for this to work.