Gitlab CI cannot pull image from private docker registry

Question

I'd like to create a Docker based Gitlab CI runner which pulls the docker images for the build from a private Docker Registry (v2). I cannot make the Gitlab Runner to pull the image from a local Registry, it tries to GET something from a /v1 API. I get the following error message:

ERROR: Build failed: Error while pulling image: Get http://registry:5000/v1/repositories/maven/images: dial tcp: lookup registry on 127.0.1.1:53: no such host

Here's a minimal example, using docker-compose and a web browser.

I have the following docker-compose.yml file:

version: "2"

services:
  gitlab:
    image: gitlab/gitlab-ce
    ports:
      - "22:22"
      - "8080:80"
    links:
      - registry:registry

  gitlab_runner:
    image: gitlab/gitlab-runner
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    links:
      - registry:registry
      - gitlab:gitlab

  registry:
    image: registry:2

After the first Gitlab login, I register the runner into the Gitlab instance:

root@130d08732613:/# gitlab-runner register
Running in system-mode.                            

Please enter the gitlab-ci coordinator URL (e.g. https://gitlab.com/ci):
http://192.168.61.237:8080/ci         
Please enter the gitlab-ci token for this runner:
tE_1RKnwkfj2HfHCcrZW
Please enter the gitlab-ci description for this runner:
[130d08732613]: docker
Please enter the gitlab-ci tags for this runner (comma separated):

Registering runner... succeeded                     runner=tE_1RKnw
Please enter the executor: docker-ssh+machine, docker, docker-ssh, parallels, shell, ssh, virtualbox, docker+machine:
docker
Please enter the default Docker image (eg. ruby:2.1):
maven:latest
Runner registered successfully. Feel free to start it, but if it's running already the config should be automatically reloaded!

After this, I see the Gitlab runner in my Gitlab instance:

After this I push a simple maven image to my newly created Docker repository:

vilmosnagy@vnagy-dell:~/$ docker tag maven:3-jdk-7 172.19.0.2:5000/maven:3-jdk7
vilmosnagy@vnagy-dell:~/$ docker push 172.19.0.2:5000/maven:3-jdk7 
The push refers to a repository [172.19.0.2:5000/maven]
79ab7e0adb89: Pushed 
f831784a6a81: Pushed 
b5fc1e09eaa7: Pushed 
446c0d4b63e5: Pushed 
338cb8e0e9ed: Pushed 
d1c800db26c7: Pushed 
42755cf4ee95: Pushed 
3-jdk7: digest: sha256:135e7324ccfc7a360c7641ae20719b068f257647231d037960ae5c4ead0c3771 size: 1794

(I got the 172.19.0.2 IP-address from a docker inspect command's output)

After this I create a test project in the Gitlab and add a simple .gitlab-ci.yml file:

image: registry:5000/maven:3-jdk-7

stages:
  - build
  - test
  - analyze

maven_build:
  stage: build
  script:
    - "mvn -version"

And after the build the Gitlab gives the error in seen in the beginning of the post.

If I enter into the running gitlab-runner container, I can access the registry under the given URL:

vilmosnagy@vnagy-dell:~/$ docker exec -it comptest_gitlab_runner_1 bash
root@c0c5cebcc06f:/# curl http://registry:5000/v2/maven/tags/list
{"name":"maven","tags":["3-jdk7"]}
root@c0c5cebcc06f:/# exit
exit
vilmosnagy@vnagy-dell:~/$

But the error still the same:

Do you have any idea how to force the gitlab-runner to use the v2 api of the private registry?

Have you tried pulling the image from inside the runner? Maybe with the "external" IP? What about pulling the image from the host? — Martin, Jul 22 '16 at 05:27
@mgansler If I enter into the gitlab_runner image (`docker exec -it comptest_gitlab_runner_1 bash`) there is no docker command. But the registry is seen, 'cause I can use the registry's HTTP API with curl. — Nagy Vilmos, Jul 25 '16 at 13:00

score 10 · Accepted Answer · edited Jun 14 '21 at 08:05

10

Current Gitlab and Gitlab Runners support this, see: https://docs.gitlab.com/runner/configuration/advanced-configuration.html#use-a-private-container-registry

On older Gitlab I've solved this with copying an auth key into ~/.docker/config.json

{
        "auths": {
                "my.docker.registry.url": {
                        "auth": "dmlsbW9zLm5hZ3k6VGZWNTM2WmhC"
                }
        }
}

I've logged into this container from my computer and copied this auth key into the Gitlab Runner's docker container.

edited Jun 14 '21 at 08:05

Community

1
1

answered Dec 21 '16 at 09:07

Nagy Vilmos

1,878
22
46

1

More precise docs are at https://docs.gitlab.com/ee/ci/docker/using_docker_images.html#access-an-image-from-a-private-container-registry – humble_wolf Dec 09 '21 at 15:49

score 1 · Answer 2 · answered Jul 25 '16 at 10:57

1

What version of docker do you run on Gitlab ? Also for a v2 registry, you have to explicitly allow insecure registry with a command line switch, or secure your registry using a certificate.

Otherwise Docker fallback to the v1 registry if it gets a security exception.

answered Jul 25 '16 at 10:57

Maël Lavault

405
3
14

The docker version is `1.11.2`, detailed version info is here: http://pastebin.com/g9ma56ME The insecure registry is set in the host OS as the following: `--insecure-registry registry:5000`. I don't know that the gitlab runner how starts the containers - which docker binary does it uses, in which file should I set the insecure registry inside the runner image, etc. The gitlab_runner image does not have a docker executable on the path, so I do not know where to start. – Nagy Vilmos Jul 25 '16 at 13:04

Gitlab CI cannot pull image from private docker registry

2 Answers2