Running a Docker image on a VM using Yandex Cloud Registry

1. Open the terminal.

2. Use the ssh-keygen command to create a new key:

   ssh-keygen -t ed25519 -C "<optional_comment>"
   

   You can specify an empty string in the -C parameter to avoid adding a comment, or you may not specify the -C parameter at all: in this case, a default comment will be added.

   After running this command, you will be prompted to specify the name and path to the key files, as well as enter the password for the private key. If you only specify the name, the key pair will be created in the current directory. The public key will be saved in a file with the .pub extension, while the private key, in a file without extension.

   By default, the command prompts you to save the key under the id_ed25519 name in the following directory: /home/<username>/.ssh. If there is already an SSH key named id_ed25519 in this directory, you may accidentally overwrite it and lose access to the resources it is used in. Therefore, you may want to use unique names for all SSH keys.

1. Install Docker Engine. Use this guide to install and run Docker for your operating system.

2. After the installation is complete, add the current user to the docker group:

   sudo groupadd docker
   sudo usermod -aG docker $USER
   newgrp docker
   

For groups to update successfully, you may need to log back into the OS or reboot the computer.

For information about additional Docker settings for Linux, see the developer documentation.

If you are working on a device with a GUI, you can also install Docker Desktop for Linux.

1. In the management console, select the folder you want to create a registry in.

2. Go to Cloud Registry.

3. Click Create registry.

4. Select Docker for the format.

5. Set the registry type to Local.

6. Enter a name for the registry. Follow these naming requirements:

   • It must be from 3 to 62 characters long.
   • It can only contain lowercase Latin letters, numbers, and hyphens.
   • It must start with a letter and cannot end with a hyphen.

7. Click Create.

1. Go to Identity and Access Management.
2. At the top of the screen, navigate to the Service accounts tab.
3. Click Create service account.
4. Specify the service account name: docker-puller.
5. Click Create.
6. Go to Cloud Registry.
7. Select the previously created registry.
8. Navigate to the Access bindings tab.
9. Click Assign roles.
10. In the window that opens, select the docker-puller service account.
11. Click Add role and select cloud-registry.artifacts.puller.
12. Click Save.

1. Go to Identity and Access Management.
2. In the list that opens, select docker-puller.
3. In the top panel, click Create new key and select Create authorized key.
4. Click Create.
5. In the window that opens, click Download file with keys and then Close

The action will download to your computer a file named authorized_key.json containing the authorized key. You will need this key later to set up Docker on your VM.

1. Go to Virtual Private Cloud.
2. Click Create network.
3. In the Name field, specify docker-ycr-network.
4. In the Advanced field, disable Create subnets.
5. Click Create network.
6. Select vipnet-network.
7. Click Create subnet at the top right.
8. In the Name field, specify docker-ycr-subnet-ru-central1-b.
9. In the Availability zone field, select ru-central1-b.
10. In the CIDR field, specify 192.168.1.0/24.
11. Click Create subnet.

1. Go to Compute Cloud.

2. Click Create virtual machine.

3. Under Boot disk image, select an image and a Linux-based OS version.

4. Under Location, select an availability zone for your VM.

5. Under Network settings:

   • In the Subnet field, select the previously created network and subnet.
   • In the Public IP address field, leave the Auto value to assign a random external IP address from the Yandex Cloud pool.

6. Under Access, specify the VM access credentials:

   • In the Login field, enter the username.
   • In the SSH key field, paste the contents of the public key file.

7. Under General information, specify the VM name: docker-vm.

8. Under Additional, select the docker-puller service account you created earlier.

9. Click Create VM.

1. Get authenticated in Cloud Registry.

2. Create a file called Dockerfile:

   echo "FROM ubuntu:latest" > Dockerfile
   echo "CMD echo 'Hello World'" >> Dockerfile
   

3. Build the Docker image:

   docker build . -t registry.yandexcloud.net/<registry_ID>/ubuntu:hello
   

   Where <registry_ID> is the ID of the registry you created earlier.

   Result:

   ...
   Successfully built db45********
   Successfully tagged registry.yandexcloud.net/cn1k31pgpovl********/ubuntu:hello
   

4. Push the Docker image to the registry:

   docker push registry.yandexcloud.net/<registry_ID>/ubuntu:hello
   

   Result:

   e8bc********: Pushed 
   hello: digest: sha256:96d... size: 529
   

1. Connect to the VM over SSH.

2. Install the CLI and restart the terminal:

   curl -sSL https://storage.yandexcloud.net/yandexcloud-yc/install.sh | bash
   exec -l $SHELL
   

3. Create a file named key.json and paste the contents of the docker-puller service account key file to it:

   sudo nano key.json
   

4. Configure the CLI for the service account:

   yc config profile create docker-puller
   yc config set service-account-key key.json
   yc config set folder-id <folder_ID>
   

   For folder-id, specify the ID of the folder containing the registry.

   Result:

   Profile 'docker-puller' created and activated
   

5. Install Docker:

   sudo apt update
   sudo apt install docker.io
   

6. Add the current user to the docker group and disconnect from the VM:

   sudo usermod -aG docker $USER
   exit
   

7. Reconnect to the VM over SSH.

8. Set up Docker:

   mkdir -p ~/.docker
   cat > ~/.docker/config.json <<'EOF'
   {
     "credHelpers": {
       "registry.yandexcloud.net": "yc"
     }
   }
   EOF
   
   sudo tee /usr/local/bin/docker-credential-yc >/dev/null <<'EOF'
   #!/usr/bin/env bash
   exec yc cloud-registry docker-credential "$@"
   EOF
   
   sudo chmod +x /usr/local/bin/docker-credential-yc
   

9. Push the Docker image to the VM:

   docker pull registry.yandexcloud.net/<registry_ID>/ubuntu:hello
   

   Result:

   hello: Pulling from cn191rncdrhd********/ubuntu
   02de********: Pull complete
   Digest: sha256:96d...
   Status: Downloaded newer image for registry.yandexcloud.net/cn191rncdrhd********/ubuntu:hello
   registry.yandexcloud.net/cn191rncdrhd********/ubuntu:hello
   

10. Run the Docker image:

    docker run registry.yandexcloud.net/<registry_ID>/ubuntu:hello
    

    Result:

    Hello World