> This page is for version 10. > For other versions, use one of these documentation indexes: > - 11 (default): https://docs.nvidia.com/base-command-manager/product-manuals/11/llms.txt > - 10: https://docs.nvidia.com/base-command-manager/product-manuals/10/llms.txt > For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.nvidia.com/base-command-manager/product-manuals/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/base-command-manager/product-manuals/_mcp/server. # Docker Registries When a user creates a new container, an image specified by the user should be used. The images are kept either locally on a host, or in a registry. The image registry can be provided by a cloud provider or locally. ## 3.1 Docker And Harbor Registries: Introduction ### 3.1.1 Docker Hub, A Remote Registry By default, Docker searches for images in Docker Hub, which is a cloud-hosted public and private image registry. Docker Hub serves a huge collection of existing images that users can make use of. Every user is allowed to create a new account, and to upload and share images with other users. Using the Docker client, a user can search for already-published images, and then pull them down to a host in order to build containers from them. When an image is found in the registry, the Docker client verifies if the latest version of the image has already been downloaded. If not, then it downloads the images, and stores them locally. It also tries to synchronize them when a new container is created. When the latest image is downloaded, Docker creates a container from the image layers that are formatted to be used by a union file system. ### 3.1.2 Local Image Registry Options: Classic Docker Registry Vs Harbor Besides using Docker Hub for the image registry, the administrator can also install a local image registry on the cluster. BCM provides two ways to integrate such a local registry with the cluster, based on existing open source projects: * The first one is the classic docker registry provided by Docker Inc, and can be useful if the registry is used by trusted users. * The second registry, Harbor, developed by VMware and introduced in NVIDIA Base Command Manager version 8.1-5, provides additional features such as security and identity management, and is aimed at the enterprise. Both options can be installed with the `cm-container-registry-setup` utility, which comes with BCM’s `cm-setup` package. ## 3.2 Docker And Harbor Registries: Setup And Configuration Docker Registry and Harbor can be installed via the `cm-container-registry-setup` command-line utility. They can also be installed via Base View in NVIDIA Base Command Manager for versions beyond 8.1-6 as follows: * The Docker Registry Deployment Wizard is launched via the Base View navigation path:\ `Containers` > `Docker` > `Docker Registry Wizard` * Either Docker Registry, or Harbor, should be chosen as a registry. * A single node is ticked for the deployment. The address, port, and the root directory for storing the container images are configured. If the head node is selected for Harbor, then the setup later on asks to open the related port on the head node. This is to make Harbor and the Harbor UI externally accessible. * In the summary page, if the `Ready for deployment` box is ticked, then the administrator can go ahead with deploying the registry. * When the deployment is complete, the Docker Registry becomes ready for use. Harbor can take a few additional minutes to be ready for use. Similar to the case of etcd nodes (section [4.2](/containerization/kubernetes#42-kubernetes-setup)), nodes that run Harbor or Docker Registry have the `datanode` option ([here](/admin/provisioning#5444-full-install-confirmation-via-datanode-setting)) when installed by BCM utilities. The option helps prevent the registry being wiped out by accident, and is added when the `cm-container-registry-setup` utility is used to install Harbor or Docker Registry. This extra protection is put into place because if a registry is wiped out, then the state of images in the container becomes incoherent and cannot be restored. #### 3.2.0.1 Harbor UI If the head node is where Harbor is to be installed, and is to be made externally accessible, then the Harbor UI can be accessed at `https://` \<*head node hostname*>`:9443`. If a different node is used for Harbor to be installed, then the related port must be forwarded locally. Harbor can be logged into by default with the `admin` user and the default `Harbor12345` password. It is recommended to change that password after the first login. #### 3.2.0.2 Dealing With A Pre-existing Kubernetes Or Harbor Installation Since Harbor uses Docker internally, and because Kubernetes customizes Docker networking, it means that nodes where Kubernetes is running cannot be reused for Harbor, and that nodes where Harbor is running cannot be reused for Kubernetes. ### 3.2.1 Docker Registry Daemon Configuration Using The Docker Registry Role The Docker Registry role is used to configure and manage the `docker-registry` daemon, and its parameters are described in table [3.1](#dockerregistry-role-parameters-table):
**Parameter** **Description**
`Domain` Main domain name (default: hostname of the node)
`Alt Domains` Alternative domain names (default: FQDN of the node)
`Port` Port (default: `5000` )
`Spool Dir` Spool directory (default: `/var/lib/docker-registry` )
*Table 3.1: Docker Registry role parameters* The values stored in the Docker Registry role are not supposed to be changed, but they are useful for the uninstall procedure, and also as a record of the settings for the administrator. ```bash [basecm10->device[basecm10]->roles[generic::docker_registry]]% environments [basecm10->device[basecm10]->roles[generic::docker_registry]->environments]% list Name (key) Value Node Environment ---------------- ------------------------- ---------------- alt_domains node001.cm.cluster no domain node001 no port 5000 no spool_dir /var/lib/docker-registry no ``` Further details on the `docker-registry` daemon can be found at [https://github.com/docker/distribution](https://github.com/docker/distribution). ### 3.2.2 Harbor Daemon Configuration Using The Harbor Role The Harbor role is used to configure and manage the `harbor` daemon. The parameters of the role are described in table [3.2](#harbor-role-parameters-table):
**Parameter** **Description**
`Domain` Main domain name (default: hostname of the node)
`Alt Domains` Alternative domain names (default: FQDN of the node)
`Port` Port (default: `9443` )
`Spool Dir` Spool directory (default: `/var/lib/harbor` )
`Default Password` Default password of the Harbor admin user (default: `Harbor12345` )
`DB Password` Password of the Harbor database (default: randomly generated)
*Table 3.2: Harbor role parameters* The values stored in the Harbor role are not supposed to be changed, but they are useful for the uninstall procedure, and also as reminder of the settings for the administrator. ```bash [basecm10->device[basecm10]->roles[generic::harbor]]% environments [basecm10->device[basecm10]->roles[generic::harbor]->environments]% list Name (key) Value Node Environment ------------------ -------------------------- ---------------- alt_domains harbor,node001.cm.cluster no db_password no domain node001 no external_network True no port 9443 no redirect_port 65535 no spool_dir /var/lib/harbor no ``` Further details on Harbor can be found at [https://vmware.github.io/harbor](https://vmware.github.io/harbor).