# Running a local container registry for Execution Environments

**URL:** <https://forum.ansible.com/t/running-a-local-container-registry-for-execution-environments/206>\
**Category:** Guides, FAQs & Howtos\
**Tags:** ansible-navigator, awx, howto, ee\
**Created:** [August 30, 2023, 11:17am UTC](https://forum.ansible.com/t/running-a-local-container-registry-for-execution-environments/206 "2023-08-30T11:17:22Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Andersson007](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/andersson007/32/89_2.png) [@Andersson007](https://forum.ansible.com/u/Andersson007)\
**Post date:** [August 30, 2023, 11:17am UTC](https://forum.ansible.com/t/running-a-local-container-registry-for-execution-environments/206/1 "2023-08-30T11:17:22Z")

</div>

# Running a local container registry for Execution Environments

After building an execution environment container image, you can push it to a registry and use on your other machines with `ansible-navigator` or in Ansible AWX/Automation controller jobs.

If you’re unfamiliar with the technology, please take a look at the [Getting started with Execution Environments guide](https://docs.ansible.com/ansible/devel/getting_started_ee/index.html).

This wiki post will show you how to set up a basic local container registry for your execution environments as a systemd unit run on behalf of a non-root user.

The shell commands were made on Fedora 33 (yeah, you’re right, I need to update it one day).

## Setting up a registry server

We assume you are logged in to your machine as a non-root user with the `sudo` permission.

#### 1. Install the required packages:

```bash
sudo dnf install -y podman httpd-tools

```

#### 2. Create directories on the host system which will be later mounted in the container running your registry:

```bash
mkdir -p ~/registry/{auth,data}

```

#### 3. Generate a file containing credentials for accessing the registry:

```bash
htpasswd -bBc ~/registry/auth/htpasswd myuser mypassword

```

In the command above, `myuser` and `mypassword` can be replaced with any value you want to use as credentials to log in to to the registry.

#### 4. Create a directory to store a systemd unit for the registry container you are about to create and change your location to the directory:

```bash
mkdir -p ~/.config/systemd/user && cd ~/.config/systemd/user

```

#### 5. Run the registry container:

```bash
podman run -d --rm --name myregistry -p 5000:5000 \
-v ~/registry/data:/var/lib/registry:z \
-v ~/registry/auth:/auth:ro,z \
-e "REGISTRY_AUTH=htpasswd" \
-e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" \
-e "REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd" \
docker.io/library/registry:latest

```

#### 6. Generate a systemd unit file based on the running `myregistry` container you created in the previous step.

For podman \< 4.4:

```bash
podman generate systemd --name myregistry --files --new

```

For podman 4.4+ use quadlets. You can create a unit file using the [podlet utility](https://github.com/containers/podlet):

```bash
podlet generate container myregistry

```

#### 7. Stop the `myregistry` container:

```bash
podman stop myregistry

```

#### 8. Reload systemd and start your registry container as a systemd unit:

```bash
systemctl --user daemon-reload
systemctl --user enable --now container-myregistry.service
systemctl --user status container-myregistry.service
loginctl enable-linger

```

From now on, your registry container will start automatically after system reboot on behalf of your current regular user.

#### 9. Open port 5000 in your firewall:

```bash
sudo firewall-cmd --add-port=5000/tcp --permanent
sudo firewall-cmd --reload

```

#### 10. Reboot your machine and check if systemd has started the unit:

```bash
systemctl --user status container-myregistry.service

```

#### 11. Check the container is running:

```bash
podman ps

CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
31ef59550685 docker.io/library/registry:latest /etc/docker/regis... 2 seconds ago Up 3 seconds 0.0.0.0:5000->5000/tcp myregistry

```

Your registry now is available by using the `myregistry:5000` URL.

## Pushing your container image to the registry

#### 1. Log in to your machine where you built your execution environment.

#### 2. Make sure `myregistry` is resolvable by DNS or the `/etc/hosts` file from your client to the IP address of your registry machine.

#### 3. Create the `registries.conf` file and put the following content in it:

```bash
mkdir -p ~/.config/containers/
  
cat > ~/.config/containers/registries.conf<<EOF
[[registry]]
location="myregistry:5000"
insecure=true
EOF

```

#### 4. Log in to the registry:

```bash
podman login myregistry:5000

```

The command will ask you a login and password. Use those you passed to the `htpasswd` command when setting up the registry.

#### 5. We assume, you have the following execution environment built locally:

```bash
podman images

REPOSITORY TAG IMAGE ID CREATED SIZE
localhost/my_ee latest 1d39f6a0fbeb 2 weeks ago 388 MB

```

#### 6. Add tags associated with the registry to the image:

```bash
podman tag localhost/my_ee myregistry:5000/my_ee:1.0
podman tag localhost/my_ee myregistry:5000/my_ee:latest

```

#### 7. Push the execution environments to the registry:

```bash
podman push myregistry:5000/my_ee:1.0
podman push myregistry:5000/my_ee:latest

```

#### 8. List the tags for the image available in the registry:

```bash
podman search --list-tags myregistry:5000/my_ee

NAME TAG
myregistry:5000/my_ee 1.0
myregistry:5000/my_ee latest

```

Now you can similarly log in to the registry from your other machines and run the execution environment with [ansible-navigator](https://docs.ansible.com/ansible/devel/getting_started_ee/run_execution_environment.html) or in your [Ansible AWX/Automation Controller jobs](https://docs.ansible.com/automation-controller/latest/html/userguide/execution_environments.html#use-an-execution-environment-in-jobs).

Thanks for reading 🙂

---

<div class="post-metadata">

**Author:** ![cybette](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/cybette/32/16_2.png) [@cybette](https://forum.ansible.com/u/cybette)\
**Post date:** [August 30, 2023, 11:47am UTC](https://forum.ansible.com/t/running-a-local-container-registry-for-execution-environments/206/2 "2023-08-30T11:47:15Z")

</div>

Looks great @Andersson007 !

---

<div class="post-metadata">

**Author:** ![jbericat](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jbericat/32/627_2.png) [@jbericat](https://forum.ansible.com/u/jbericat)\
**Post date:** [September 26, 2023, 4:31am UTC](https://forum.ansible.com/t/running-a-local-container-registry-for-execution-environments/206/3 "2023-09-26T04:31:37Z")

</div>

Oh, I didn’t know that we could create local registries, that’s pretty neat @Andersson007! bookmarking post in 3,2,1… 🚀

---

<div class="post-metadata">

**Author:** ![felixfontein](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/felixfontein/32/7530_2.png) [@felixfontein](https://forum.ansible.com/u/felixfontein)\
**Post date:** [September 26, 2023, 5:19am UTC](https://forum.ansible.com/t/running-a-local-container-registry-for-execution-environments/206/4 "2023-09-26T05:19:55Z")

</div>

> [@Andersson007](#):
>
> #### 5. Run the registry container:
> 
> ```auto
> podman run -d --rm --name myregistry -p 5000:5000 \
> -v ~/registry/data:/var/lib/registry:z \
> -v ~/registry/auth:/auth:z \
> -e "REGISTRY_AUTH=htpasswd" \
> -e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" \
> -e "REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd" \
> docker.io/library/registry:latest
> 
> ```

I would probably use `-v ~/registry/auth:/auth:ro,z` so that the container cannot modify anything in `/auth`.

---

<div class="post-metadata">

**Author:** ![Andersson007](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/andersson007/32/89_2.png) [@Andersson007](https://forum.ansible.com/u/Andersson007)\
**Post date:** [September 26, 2023, 7:43am UTC](https://forum.ansible.com/t/running-a-local-container-registry-for-execution-environments/206/5 "2023-09-26T07:43:45Z")

</div>

@jbericat thanks for the feedback! I’m happy it helps!

@felixfontein thanks for the suggestion! Tested and updated the guide with `ro`

---

<div class="post-metadata">

**Author:** ![micdeli](https://avatars.discourse-cdn.com/v4/letter/m/ea666f/32.png) [@micdeli](https://forum.ansible.com/u/micdeli)\
**Post date:** [September 10, 2024, 6:20pm UTC](https://forum.ansible.com/t/running-a-local-container-registry-for-execution-environments/206/6 "2024-09-10T18:20:22Z")

</div>

This is so cool! Thank you

---

<div class="post-metadata">

**Author:** ![hgolden](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/hgolden/32/4744_2.png) [@hgolden](https://forum.ansible.com/u/hgolden)\
**Post date:** [September 14, 2024, 7:15pm UTC](https://forum.ansible.com/t/running-a-local-container-registry-for-execution-environments/206/7 "2024-09-14T19:15:54Z")

</div>

Step 6 in creating the registry doesn’t work under Podman 4.4+. You need to use Quadlet. See [https://linuxconfig.org/how-to-run-podman-containers-under-systemd-with-quadlet](https://linuxconfig.org/how-to-run-podman-containers-under-systemd-with-quadlet)

---

<div class="post-metadata">

**Author:** ![hgolden](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/hgolden/32/4744_2.png) [@hgolden](https://forum.ansible.com/u/hgolden)\
**Post date:** [September 14, 2024, 8:03pm UTC](https://forum.ansible.com/t/running-a-local-container-registry-for-execution-environments/206/8 "2024-09-14T20:03:48Z")

</div>

The podlet command can be used to generate the necessary systemd units. See: [GitHub - containers/podlet: Generate Podman Quadlet files from a Podman command, compose file, or existing object](https://github.com/containers/podlet)

---

<div class="post-metadata">

**Author:** ![Andersson007](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/andersson007/32/89_2.png) [@Andersson007](https://forum.ansible.com/u/Andersson007)\
**Post date:** [September 16, 2024, 8:30am UTC](https://forum.ansible.com/t/running-a-local-container-registry-for-execution-environments/206/9 "2024-09-16T08:30:33Z")

</div>

@hgolden thanks a lot for the feedback! I’ve changed the guide, please take a look. Any further feedback will be much appreciated