Docker Registry (Distribution) 3.1

Docker Registry is powered by the CNCF Distribution project, the reference open source container image registry that Docker Hub and most private registries are built on. It is a stateless, highly scalable server application that stores and distributes OCI and Docker container images. This cloudimg image installs the official pinned Distribution v3.1.1 release binary on Ubuntu 24.04 LTS, verified against a sha256 checksum, and runs it under systemd. Docker itself is not required to run the registry.

Security is built in and there is no anonymous access. The registry binds to loopback only with no authentication at that layer; nginx is the sole network facing surface. On first boot each VM generates its own random admin credential into a bcrypt htpasswd file and regenerates a fresh self signed TLS certificate whose subject alternative names include the VM public IP and hostname. Anonymous requests to the API return HTTP 401 with a Basic authentication challenge; only the per instance credential is accepted, and it is stored in a root only file on the VM.

nginx terminates TLS on port 443 and proxies to the registry with the directives container clients need, including unlimited body size and chunked transfer for large layers. Port 80 redirects to HTTPS, with an unauthenticated health endpoint for load balancers. Image blobs live on a dedicated 20 GiB Azure data disk, and the storage backend can be switched to Azure Blob or S3 for larger deployments.

Distribution is Apache 2.0 licensed, free and open source with no per CPU or per deployment fee. cloudimg provides packaging, credential and TLS automation, security patching, and 24/7 support with a guaranteed 24 hour response SLA.