How to pull from GitLab's Docker Registry in .gitlab-ci.yml? - gitlab

Question

I recently switched on GitLab's Docker Registry feature and it works quite well on my desktop. The next step for us is to use the registry when building our software via GitLab CI. Instead of build a docker image, which is described in various ways in the documentation and on several medium.com posts which the official twitter account mentions, I can not find a way to pull our own images from GitLab's registry.
If we specify an image from the registry via the image directive in .gitlab-ci.yml we get an authorization error (I expected that the worker perhaps authorize themselves transparently, but this is not the case):
Running with gitlab-ci-multi-runner 1.4.1 (fae8f18)
Using Docker executor with image registry.host.tld/NAMESPACE/PROJECT:latest ...
Pulling docker image registry.host.tld/NAMESPACE/PROJECT:latest ...
ERROR: Build failed (system failure): API error (500): Get https://registry.host.tld/v2/NAMESPACE/PROJECT/manifests/latest: error parsing HTTP 403 response body: no error details found in HTTP response body: "{\"message\":\"forbidden\",\"status\":\"error\",\"http_status\":403}"
So someone on the worker should call docker login. Two problems with that:
We authenticate our users via LDAP. Should we really create a static user just for the CI server?
We have quite a few worker running here. That's a lot of work to SSH'd into every single one.
Do I have overlooked something very obvious or should I go the route of docker login on every worker node?
We run GitLab 8.10.6.

Answer 1

I had this problem, too.
There is also an issue about that on the gitlab-ci-multi-runner project:
https://gitlab.com/gitlab-org/gitlab-ci-multi-runner/issues/1663
Refering to the docs you should just Login in to the private registry on the machine qhere the gitlab-runner runs:
enter link description here
If you are using the gitlab-runner inside a docker container you have to mount the file with the login credentials into the gitlab runner container.
So the command to run the gitlab container looks like this:
docker run -d --name gitlab-runner --restart always \
-v /var/run/docker.sock:/var/run/docker.sock \
-v /srv/gitlab-runner/config:/etc/gitlab-runner \
-v /root/.docker/config.json:/root/.docker/config.json \
gitlab/gitlab-runner
Refering to this example root musst login to the registry:
docker login https://registry.host.tld:5000
The important part here is the URI for the registration. I got an error similar to your's and overcame it by running:
docker login https://registry.host.tld:5000/v2/
This may be different on other registries, you have to look at the eoor message and use the part before 'namespace/project/ as login path.
E.g. if the Error message looks like this:
ERROR: Build failed (system failure): API error (500):
Get https://registry.host.tld/v1/NAMESPACE/PROJECT/manifests/latest:
error parsing HTTP 403 response body: no error details found in HTTP response body: "
{\"message\":\"forbidden\",\"status\":\"error\",\"http_status\":403}"
The login musst be:
docker login https://registry.host.tld/v1/
Hope this helps.