--- title: Private Docker Registries and the Canonical Distribution of Kubernetes description: This blog post refers to an earlier version of Charmed Kubernetes. For the current methods of dealing with registries, please see the official documentation. This originally appeared on Tim Van Steenburgh’s blog How do I use a private image registry with my Kubernetes cluster? How do I set up my own registry? Let’s look at […] url: https://canonical.com/blog/private-docker-registries-and-the-canonical-distribution-of-kubernetes?format=md --- 1. [Blog](https://canonical.com/blog) 2. Article --- [Tim Van Steenburgh](https://canonical.com/blog/author/tvansteenburgh "More about Tim Van Steenburgh") 11 October 2017 # Private Docker Registries and the Canonical Distribution of Kubernetes [containers](https://canonical.com/blog/tag/containers) [CUDA](https://canonical.com/blog/tag/cuda) [docker](https://canonical.com/blog/tag/docker) [kubernetes](https://canonical.com/blog/tag/kubernetes) [nvidia](https://canonical.com/blog/tag/nvidia) --- Share the article This blog post refers to an earlier version of Charmed Kubernetes. For the current methods of dealing with registries, please see the [official documentation](https://ubuntu.com/kubernetes/docs/docker-registry). This originally appeared on [Tim Van Steenburgh’s blog](https://medium.com/@tvansteenburgh/private-docker-registries-and-the-canonical-distribution-of-kubernetes-31cb05a9b61c) How do I use a private image registry with my Kubernetes cluster? How do I set up my own registry? Let’s look at how to perform these tasks on the [Canonical Distribution of Kubernetes (CDK)](https://www.ubuntu.com/kubernetes). ## Using an Existing Insecure Registry In order to connect to an insecure registry, the Docker daemon must be reconfigured and an `--insecure-registry` option must be added. This can be done directly via Juju, using the command: ``` juju config kubernetes-worker docker-config=”--insecure-registry registry.domain.com:5000" ``` ## Creating a Secure CDK Registry CDK provides an option to deploy a secure Docker registry within the cluster, and expose it via an ingress. **Note:** The registry provided is **not** a production grade registry, and should not be used in a production context. ### Requirements To deploy and use the provided registry, you will need: * A DNS entry (registry.acme.com) pointing at the ingress of the cluster (directly, via DNS round robin or with a load balancer) * A valid TLS certificate and key for registry.acme.com (registry.crt and registry.key) * A set of usernames and passwords stored in a file for htpasswd authentication (format: username:password, one user per line) Considering a htpasswd.cleartxt file filled with users, the following loop will generate an encoded version of it: ``` while read line do USER=$(echo ${line} | cut -f1 -d':') PASS=$(echo ${line} | cut -f2 -d':') docker run \ --rm \ xmartlabs/htpasswd \ ${USER} ${PASS} \ | tee -a htpasswd.enc done < htpasswd.cleartxt sed -i "/^$/d" htpasswd.enc ``` ### Deployment To deploy the registry, run: ``` juju run-action kubernetes-worker/0 registry \ domain=registry.acme.com \ htpasswd=”$(base64 -w0 htpasswd.enc)” \ htpasswd-plain=”$(base64 -w0 htpasswd.cleartxt)” \ tlscert=”$(base64 -w0 registry.crt)” \ tlskey=”$(base64 -w0 registry.key)” \ ingress=true ``` ### Tear down To tear down the registry, run ``` juju run-action kubernetes-worker/0 registry \ delete=true \ ingress=true ``` ### Storage The registry provided by CDK will use a `/srv/registry` hostPath to store the images. This means that in case of a rescheduling of the registry (failure, overload…), if the new pod is scheduled on a different host, you will lose your images. Alternatively, you can use a network mount such as NFS on all workers to benefit from a single point of storage for the images. ### Ingress Configuration The CDK registry action makes the assumption that the ingress running is nginx and will enforce a change of the configuration to increase the `client_max_body_size` from 1MB to 1GB. This is done via a patch, hence will not overwrite other configuration keys. If you are using another ingress, deploy with `ingress=false` and make sure your ingress will support image upload (typical images are ~300MB, and typical CUDA images are 1 to 4GB) ## Alternatives If you want a similar setup but with flexibility on the storage and management via native Kubernetes tools you will find a derived work delivered via a Helm chart on If you’d like to follow along more closely with CDK development, you can do so in the following places: * (cluster/juju directory) * * Kubernetes [Slack channels](http://slack.k8s.io/) and [SIG meetings](https://kubernetes.io/community/) * #juju on Freenode IRC * juju@lists.ubuntu.com mailing list Until next time! ## Sign up for our newsletter Get the latest Canonical news and updates in your inbox. Work email: \*I agree to receive information about Canonical's products and services. By submitting this form, I confirm that I have read and agree to [Canonical's Privacy Policy](https://canonical.com/legal/dataprivacy). Sign up ## Share on --- ## Related posts [### Canonical joins the Open Secure AI Alliance](https://canonical.com/blog/open-secure-ai-alliance) Canonical is now part of the Open Secure AI Alliance, announced by NVIDIA with partners across cloud computing, cybersecurity, enterprise software, open source foundations, and... [Canonical](https://canonical.com/blog/author/canonical) 28 August 2026 [### Securing AI agent workflows on Ubuntu with the new NVIDIA OpenShell snap](https://canonical.com/blog/nvidia-openshell-ubuntu-announcement) By packaging OpenShell as a snap, Canonical is enabling enterprises to confidently run next-generation agentic workflows across local devices, hybrid environments, and private clouds. [Canonical](https://canonical.com/blog/author/canonical) 1 June 2026 [### Run NVIDIA Nemotron 3 Nano Omni locally in a single command](https://canonical.com/blog/nvidia-nemotron-3-nano-omni) Today, NVIDIA introduced the NVIDIA Nemotron™ 3 Nano Omni, a highly-efficient multimodal model designed to understand and reason across video, audio, images, and language.... [Canonical](https://canonical.com/blog/author/canonical) 28 April 2026 [### Canonical welcomes NVIDIA’s donation of the GPU DRA driver to CNCF](https://canonical.com/blog/canonical-nvidia-kubecon-2026) At KubeCon Europe in Amsterdam, NVIDIA announced that it will donate the GPU Dynamic Resource Allocation (DRA) Driver to the Cloud Native Computing Foundation (CNCF). This... [Abdelrahman Hosny](https://canonical.com/blog/author/abdelrahman-hosny-m) 24 March 2026