> This page is for version 11 (default). > For other versions, use one of these documentation indexes: > - 11 (default): https://docs.nvidia.com/base-command-manager/product-manuals/11/llms.txt > - 10: https://docs.nvidia.com/base-command-manager/product-manuals/10/llms.txt > For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.nvidia.com/base-command-manager/product-manuals/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/base-command-manager/product-manuals/_mcp/server. # Container Registries When a user creates a new container, an image specified by the user should be used. The images are kept either locally on a host, or in a registry. The image registry can be provided by a cloud provider or locally. ## 3.1 Container Registries: Introduction ### 3.1.1 Docker Hub, A Remote Registry By default, Docker searches for images in Docker Hub, which is a cloud-hosted public and private image registry. Docker Hub serves a huge collection of existing images that users can make use of. Every user is allowed to create a new account, and to upload and share images with other users. Using the Docker client, a user can search for already-published images, and then pull them down to a host in order to build containers from them. When an image is found in the registry, the Docker client verifies if the latest version of the image has already been downloaded. If not, then it downloads the images, and stores them locally. It also tries to synchronize them when a new container is created. Docker Hub maintains limits for the number of requests. To help get around the issues caused by the limits: * A personal account can be created on Docker Hub, and the credentials used for pulls. Authenticated requests for personal accounts have a greater pull rate allowance than unauthenticated requests. * A Pro, Team, or Business account ([https://docs.docker.com/docker-hub/usage/pulls/](https://docs.docker.com/docker-hub/usage/pulls/)) can be created on Docker Hub, and the credentials used for pulls. Authenticated requests for these accounts have an unlimited pull rate allowance. * For a connected cluster, configuring a Docker Registry as a caching proxy mirror for Docker Hub (section [3.2.1](#321-docker-registry-as-a-pull-through-cache-for-docker-hub)) reduces the number of Docker Hub GET requests. * Using Skopeo to manage container images and repositories helps minimize pulls for air-gapped clusters (Appendix [C](/containerization/kubernetesairgapupgrade)). ### 3.1.2 Local Image Registry Options: Classic Docker Registry Vs Harbor Besides using Docker Hub for the image registry, the administrator can also install a local image registry on the cluster. BCM provides two ways to integrate such a local registry with the cluster, based on existing open source projects: * The first one is the classic Docker registry originally provided by Docker Inc, and can be useful if the registry is used by trusted users, or when a Docker Hub proxy cache is required. Maintenance has been handed over to the CNCF, and future releases will be named CNCF Distribution. * The second registry, Harbor, provides additional features such as security and identity management, and is aimed at the enterprise. Both options can be installed with the `cm-container-registry-setup` utility, which comes with BCM’s `cm-setup` package. ## 3.2 Container Registries: Setup And Configuration Docker Registry and Harbor can be installed using the `cm-container-registry-setup` TUI utility, which comes with the `cm-setup` package. They can also be installed using Base View as follows: * The Container Registry Deployment Wizard is launched via the Base View navigation path:\ `Containers` > `Container Registry Wizard` * Either Docker Registry, or Harbor, should be chosen as a registry. * A single node is ticked for the deployment. The address, port, and the root directory for storing the container images are configured. If the head node is selected for Harbor, then the setup later on asks to open the related port on the head node. This is to make Harbor and the Harbor UI externally accessible. * In the summary page, if the `Ready for deployment` box is ticked, then the administrator can go ahead with deploying the registry. * When the deployment is complete, the Docker Registry becomes ready for use. Harbor can take a few additional minutes to be ready for use. Similar to the case of etcd nodes (section [4.2](/containerization/kubernetes#42-kubernetes-setup)), nodes that run Harbor or Docker Registry have the `datanode` option ([here](/admin/provisioning#5444-full-install-confirmation-using-datanode-setting)) when installed by BCM utilities. The option helps prevent the registry being wiped out by accident, and is added when the `cm-container-registry-setup` utility is used to install Harbor or Docker Registry. This extra protection is put into place because if a registry is wiped out, then the state of images in the container becomes incoherent and cannot be restored. ### 3.2.1 Docker Registry As A Pull Through Cache For Docker Hub Docker Hub has a pull rate limit since November 2020 to limit the number of images that can be pulled per hour ([https://docs.docker.com/docker-hub/usage/](https://docs.docker.com/docker-hub/usage/)). To limit the number of direct requests to Docker Hub, Docker Registry can be configured as a caching proxy mirror for Docker Hub. When configured as a proxy mirror, Docker Registry serves cached images from Docker Hub, and downloads content from Docker Hub only when required. Docker Registry is configured for proxy mode by selection during a `cm-container-registry-setup` run (figure [3.1](#fig-cm-container-registry-setup-proxy-mode)): ![cm-container-registry-setup: configure Docker Registry as proxy cache](/base-command-manager/product-manuals/_fern-files/nvidia-bcm-manuals.docs.buildwithfern.com/9db87f8f68929a2f999f82335f3e7be0af25818216fd7b205f34cce489a2249b/_dot_dot_/_dot_dot_/_dot_dot_/_dot_dot_/_dot_dot_/_dot_dot_/tmp/tmp-465-wPoXzKKBLZez/latextofern/fern/assets/figures/cm-container-registry-setup-proxy-mode.png) *Figure 3.1: cm-container-registry-setup: configure Docker Registry as proxy cache* To access the proxy mirror, the port must be specified with the URL. For example, if Docker Registry is installed on `node001` using the default port, (`5000`) with `cm-kubernetes-setup`, then it is specified for Kubernetes as [https://node001:5000](https://node001:5000) (figure [3.2](#fig-cm-kubernetes-setup-local-registry-mirror)): ![cm-kubernetes-setup: configuring a local proxy mirror](/base-command-manager/product-manuals/_fern-img/19da2ab6ef245312a1dcf021464c53a9aeeb982effafa5a9023c04b8e4020331.webp) *Figure 3.2: cm-kubernetes-setup: configuring a local proxy mirror* For example, if a Docker Registry proxy cache is configured on `node001`, port `5000`, then the `hello-world` image is pulled explicitly through the proxy with: **Example** ```bash root@node001:~# docker run node001:5000/library/hello-world Unable to find image 'node001:5000/library/hello-world:latest' locally latest: Pulling from library/hello-world 17eec7bbc9d7: Pull complete Digest: sha256:f7931603f70e13dbd844253370742c4fc4202d290c80442b2e68706d8f33ce26 Status: Downloaded newer image for node001:5000/library/hello-world:latest Hello from Docker! This message shows that your installation appears to be working correctly. ... ``` ### 3.2.2 Harbor UI If the head node is where Harbor is to be installed, and is to be made externally accessible, then the Harbor UI can be accessed at `https://` \<*head node hostname*>`:9443`. If a different node is used for Harbor to be installed, then the related port must be forwarded locally. Harbor can be logged into by default with the `admin` user and the default `Harbor12345` password. It is recommended to change that password after the first login. ### 3.2.3 Docker Registry And Harbor Configuration Configuration is carried out using generic roles, which are roles with the prefix `generic::`, and that follow a generic template used by many roles. * Generic Docker Registry configuration is managed with the `generic::docker-registry` role. The `docker-registry` daemon is documented upstream at [https://github.com/docker/distribution](https://github.com/docker/distribution). * Generic Harbor configuration is managed with the `generic::harbor` role. The Harbor registry is documented upstream at [https://goharbor.io](https://goharbor.io). Inspecting the options in the roles for Docker and Harbor shows what can be managed.