Hello everyone! Today, we’re going to delve into one of the most frequently asked questions when operating Docker Swarm mode: private registry authentication and container secure networking. Based on design philosophy, I’ll share insights beyond simple command explanations, focusing on ‘why it was designed this way.’ π¨βπ«
1. –with-registry-auth, What exactly are you? π€
To use images from a private registry (e.g., AWS ECR, Azure ACR, Self-hosted Harbor, etc.) in Docker Swarm, you perform a docker login on the manager node. However, when you actually deploy, worker nodes often fail to pull images, throwing “No such image” or “Access Denied” errors.
This is where the –with-registry-auth option comes in like a savior.
βοΈ How it Works: The Journey of an Authentication Token
- Manager Node: Stores the authentication token obtained via docker login in ~/.docker/config.json.
- Command Execution: The user issues a stack deploy command with the –with-registry-auth option.
- Token Delivery: The manager node temporarily transmits its authentication information via the Swarm API to all worker nodes that will run the service.
- Image Pull: The worker nodes use the freshly delivered token to access the registry and pull the image.
π‘ Key Point:
This authentication information is not permanently stored on the worker nodes.
For security, it is volatile data transmitted ‘momentarily’ only at the time of deployment.
2. “It’s annoying to type every time, can’t it be automated?” π«
To put it simply, there is no official Docker design method to enable this option globally (by default). From a security expert’s perspective, this is a very reasonable design.
π Security Design Philosophy: Explicit Control
If this option were a default, the manager’s sensitive authentication token would be broadcast across the network to all nodes every time any service is deployed. This violates the Principle of Least Privilege. By requiring the operator to explicitly decide whether a specific deployment needs authentication, security incidents are prevented.
π οΈ Practical Solution (Tip)
If you want to avoid the stress of typing it every time, actively utilize Shell Alias.
Bash
# Register in .bashrc or .zshrc
alias dsd='docker stack deploy --with-registry-auth'
alias dsu='docker service update --with-registry-auth'Now, a single line `dsd -c docker-compose.yml web` solves all authentication issues.
3. The Core of Internal Network Security: expose vs ports π
When configuring services in a Swarm environment, how do you set up databases or internal API servers that don’t need external exposure? This is where the true value of `expose` shines.
| Category | ports (Port Forwarding) | expose (Internal Only) |
|---|---|---|
| Accessibility | Accessible from external internet/host | Accessible only within the same Docker network |
| Security | Door wide open (risk exposure) | Door opened only to necessary internal collaborators |
| Usage | Web servers (Nginx), external API endpoints | Database, Redis, Internal Microservices |
For enhanced security, we recommend a design where “only external entry points (Gateways) open `ports`, and everything else is isolated with `expose`.”
4. Real-world Troubleshooting: OpenSearch Security Initialization Error and Disk Full π¨
Recently, when deploying OpenSearch with Docker Compose, you might encounter the following message:
opensearch security not initialized
This error occurs when the security plugin is enabled, but the .security index, which holds the settings, has not been created. If you’ve correctly set the environment variable (OPENSEARCH_INITIAL_ADMIN_PASSWORD) and it still doesn’t work, the culprit is likely disk space (Disk Full).
π Disk Space and OpenSearch Relationship
OpenSearch (Elasticsearch family) locks all indices into Read-only mode to protect data if disk usage exceeds 95%.
- Problem Occurs: Disk is full, causing .security index creation to fail.
- Check Logs: Look for “No space left on device” or “Disk watermark exceeded” in `docker compose logs`.
- Solution:
- Clean up unnecessary images/volumes with `docker system prune -a`.
- Completely remove corrupted volumes with `docker-compose down -v` and restart.
- Ensure sufficient free space (at least 10GB recommended) before redeploying.
5. Conclusion: Towards a Better DevOps Environment ποΈ
Docker Swarm is a lighter and powerful tool compared to Kubernetes. However, if you don’t accurately understand the meaning of options like –with-registry-auth, you might encounter unexpected operational failures (Image Pull Error).
To summarize what we’ve covered today:
- –with-registry-auth is a security mechanism that transmits authentication tokens to worker nodes.
- To avoid inconvenience, use Alias.
- Establish minimum security boundaries between services using expose.
- The foundation of infrastructure begins with resource management (disk space).
Leave a Reply