VMware Lightboards - Intro to Containers, 25 May 2017

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Container Registry

Description

In this lightboard talk, Haining Zhang walks you thought what container registry is and how it works.

For more information, please visit the VMware’s Cloud-Native Apps website:
https://cloud.vmware.com/cloud-native-apps

A

Thank you hi. My name is hiding Zeng I'm, the chief architect of Willmar China, AMD I, am also the creator and architect of project Harbor. The open source enterprise class registry server today I'll be talking about what a container registry is and how we can manage. Container images securely and efficient efficiently by a private registry container is isolated environment created by an operating system to run some application. If we take a snapshot of this container five systems, we will have a container image.

A

The container image, basically is a bunch of static files on disk. Once we get this image we can have, we can spin up multiple instances of container based on this template. The container image is the template for us to swinger multiple instances.

A

These engine instances are identical to the original one, so canina image is a way to help. You scale out your application quickly.

A

Besides, that container image can be used to ship your applications from one system to another. The way to do so is to use a registry service. The registry service, basically, is a repository.

A

They can help you score your continued image. You can upload your image to the registry and store copy there. This process is called push.

A

On another system.

A

You can download the image.

A

So you can have a copy there, and this process is called pool.

A

Once you have the image on another system, you can run the same application using container.

A

These containers are running apps, which are exactly the same as the original hosts. As you can see, our container is a very powerful way to help you to ship your applications from one place to the other, and the registry acts as the intermediary for sharing images between systems.

A

The next thing I'm going to talk about is where you can find the refugee service to use, to store and ship your application. An easier way is to find a public chat service such as toca hub.

A

As long as the systems are connected to the Internet, you can push image 2 or pull images from the docker hub directly, although it's handy for us to use a talk hub or to share our images. Most users today are choose to set up their own instance of registry service within their organization.

A

This is possibly because not all of that computers or systems can access the internet, so they need to have a local registry instance. There are also some important considerations behind it. First, your organization's may be required to keep its IP or intellectual properties within the organization's container. Images may contain very sensitive information that you don't want to put into a public registry service.

A

Second, a private registry can prevent images with malware or vulnerabilities from getting into the organization. Moreover, you can perform regular scanning.

A

On the local image to find out any vulnerabilities and then apply patches accordingly, third, you can import row based access control on your local images.

A

Organizations usually have different peoples, they are, we have different roles and they should have different access to the images store in the registry. So role based access control can be applied to all the image operations here to enforce the rules.

A

For example, people with a developer role can push image to the registry and prove on the registry as well for people without test at all. They don't need to push to the image, so we don't give them the push access. They only have to pull access for the from the res registry.

A

In addition, most organizations have a central user management system such as LDAP or ad for Active Directory, and the user identity can be linked directly into a registry and then used for row based access control. The next consideration is prominence.

A

You can set up a local service within your organization called noir 3.

A

When you are pushing an image to a registry, the pusher can actually digitally sign the image and store the signature.

A

On the notary, when I mean in another system, when the image is being pulled from the registry, the signature is being checked and verified.

A

If the image with the untrod is signed by an untrusted party or it doesn't have any signature at all, the polling will fail.

A

Last but not least, clouding tip applications usually consists of many containers in a modern, a drug development process. Container images are usually viewed dozens of times or even hundreds of times today is safe, a huge amount of time by pushing or pulling images from a local registry.

A

For these reasons, organizations need a private registry inside their organizations to be securely and efficiently using their content. Container images. The open source project harbor that I'm working on is the private registries for enterprise. It helps manage container images securely and efficiently.

A

It is available as part of the vSphere integrated containers offering the open source version of harbor is also available for download on github. You can download it from the this URL.