Start registry via systemd

Use-case

Using systemd to manage containers can make service discovery and maintenance easier by managing all services in the same way. Additionally, when using Podman, systemd can start the registry with socket-activation, providing additional security options:

  • Run as non-root and expose on a low-numbered socket (< 1024)
  • Run with --network=none

Docker

When deploying the registry via Docker, a simple service file can be used to manage the registry:

registry.service

  1. [Unit]
  2. Description=Distribution registry
  3. After=docker.service
  4. Requires=docker.service
  6. [Service]
  7. #TimeoutStartSec=0
  8. Restart=always
  9. ExecStartPre=-/usr/bin/docker stop %N
  10. ExecStartPre=-/usr/bin/docker rm %N
  11. ExecStart=/usr/bin/docker run --name %N \
  12.     -v registry:/var/lib/registry \
  13.     -p 5000:5000 \
  14.     registry:2
  16. [Install]
  17. WantedBy=multi-user.target

In this case, the registry will store images in the named-volume registry. Note that the container is destroyed on restart instead of using --rm or destroy on stop. This is done to make accessing docker logs ... easier in the case of issues.

Podman

Podman offers tighter integration with systemd than Docker does, and supports socket-activation of containers.

Create service file

  1. podman create --name registry --network=none -v registry:/var/lib/registry registry:2
  2. podman generate systemd --name --new registry > registry.service

Create socket file

registry.socket

  1. [Unit]
  2. Description=Distribution registry
  4. [Socket]
  5. ListenStream=5000
  7. [Install]
  8. WantedBy=sockets.target

Installation

Installation can be either rootful or rootless. For Docker, rootless configurations often include additional setup steps that are beyond the scope of this recipe, whereas for Podman, rootless containers generally work out of the box.

Rootful

Run as root:

  • Copy registry.service (and registry.socket if relevant) to /etc/systemd/service/
  • Run systemctl daemon-reload
  • Enable the service:
    • When using socket activation: systemctl enable registry.socket
    • When not using socket activation: systemctl enable registry.service
  • Start the service:
    • When using socket activation: systemctl start registry.socket
    • When not using socket activation: systemctl start registry.service

Rootless

Run as the target user:

  • Copy registry.service (and registry.socket if relevant) to ~/.config/systemd/user/
  • Run systemctl --user daemon-reload
  • Enable the service:
    • When using socket activation: systemctl --user enable registry.socket
    • When not using socket activation: systemctl --user enable registry.service
  • Start the service:
    • When using socket activation: systemctl --user start registry.socket
    • When not using socket activation: systemctl --user start registry.service

Note: To have rootless services start on boot, it may be necessary to enable linger via loginctl enable-linger $USER.