Get started
Language / Region
© 2021 Yandex.Cloud LLC
Yandex Container Registry

Running a Docker image on a VM

Written by

    This example describes the steps required to run a Docker image on a virtual machine using a registry.

    This example describes the steps required to run a Docker image on a VM using a registry. If you don't have a VM yet, create one.

    1. Create a service account and assign it the role container-registry.images.puller for the registry from the example:

      1. In the management console, select the folder where you want to create a service account.
      2. Go to the Service accounts tab.
      3. Click Create service account.
      4. Enter the service account name and click Create.
      5. In the list of services, select Container Registry.
      6. To the right of the registry name, click and select Configure ACL.
      7. In the window that opens, select the service account and click Add.
      8. In the Permissions drop-down list, select the role container-registry.images.puller.
      9. Click Save.

      1. Create a service account:

        If you don't have the Yandex.Cloud command line interface yet, install and initialize it.

        The folder specified in the CLI profile is used by default. You can specify a different folder using the --folder-name or --folder-id parameter.

        yc iam service-account create --name service-acc

        Command results::

        id: ajelabcde12f33nol1v5
folder_id: b0g12ga82bcv0cdeferg
created_at: "2020-11-30T14:32:18.900092Z"
name: service-acc

      2. Assign the role to the service account:

        yc <service_name> <resource> add-access-binding <resource_name>|<resource_ID> \
  --role <role_ID> \
  --subject serviceAccount:<service account ID>

        Where:

        • <service_name>: Name of a container service.
        • <resource>: Category of the registry resource.
        • <resource_name>: Name of the resource that the role is assigned for. You can specify a resource by its name or ID.
        • <resource_ID>: ID of the crpc9qeoft236r8tfalm registry the role is assigned for.
        • <role_ID>: ID of the container-registry.images.puller role.
        • <service_account_ID>: ID of the ajelabcde12f33nol1v5 service account that is assigned the role.

      Use the updateAccessBindings method for the registry resource.

    2. Create a VM with a public IP address and link the service account you created to it:

      1. In the management console, select the folder to create your VM in.

      2. In the list of services, select Compute Cloud.

      3. Click Create VM.

      4. Under Basic parameters:

        • Enter a name and description for the VM. Naming requirements:

          • Length — from 3 to 63 characters.
          • The name may contain lowercase Latin letters, numbers, and hyphens.
          • The first character must be a letter. The last character can't be a hyphen.

          Note

          The VM name is used to generate the FQDN only once, when creating the VM. If the FQDN is important to you, choose an appropriate name for the VM at the creation stage.

        • Select the recently created service account.

        • Select the availability zone to host the VM in.

      5. Under Images from Cloud Marketplace, select an image and Linux-based OS version.

      6. (optional) Configure the boot disk under Disks:

        • Specify the necessary disk size.
        • Select the disk type.

        If you want to create an instance from an existing disk, go to Disks add a disk.

      7. Under Computing resources:

      8. Under Network settings:

        • Specify the subnet ID or select a cloud network from the list. If you don't have a network, click Create a new network to create one:
          • In the window that opens, enter a name for the new network and choose a subnet to connect the virtual machine to. Each network must have at least one subnet (if there's no subnet, create one). Then click Create.
        • In the Public IP field, choose a method for assigning an IP address:
          • Auto: Assign a random IP address from the Yandex.Cloud IP pool.
          • List: Select a public IP address from the list of previously reserved static addresses. For more information, see Making a dynamic public IP address static.
          • No address: Don't assign a public IP address.
        • (optional) Enable DDoS protection.

      9. Under Access, specify the data required to access the VM:

        • Enter the username in the Login field.

          Alert

          Don't use the username root or other names reserved by the operating system. To perform operations that require superuser permissions, use the command sudo.

        • In the SSH key field, paste the contents of the public key file.

      10. Click Create VM.

      1. View the description of the CLI command for creating a VM:

        yc compute instance create --help

      2. Prepare the key pair (public and private keys) for SSH access to the VM.

      3. Select one of the public images with a Linux OS (for example, CentOS 7).

        To get a list of available images, run the following command:

        yc compute image list --folder-id standard-images

        Command execution result:

        +----------------------+-------------------------------------+--------------------------+----------------------+--------+
|          ID          |                NAME                 |          FAMILY          |     PRODUCT IDS      | STATUS |
+----------------------+-------------------------------------+--------------------------+----------------------+--------+
...
| fdvk34al8k5nltb58shr | centos-7-1549279494                 | centos-7                 | dqni65lfhvv2den5gtv9 | READY  |
| fdv7ooobjfl3ts9gqp0q | windows-2016-gvlk-1548913814        | windows-2016-gvlk        | dqnnc72gj2ist3ktjj1p | READY  |
| fdv4f5kv5cvf3ohu4flt | ubuntu-1604-lts-1549457823          | ubuntu-1604-lts          | dqnnb6dc7640c5i968ro | READY  |
...
+----------------------+-------------------------------------+--------------------------+----------------------+--------+

      4. Select a subnet:

        yc vpc subnet list
+----------------------+-----------------------+----------------------+----------------+---------------+-----------------+
|          ID          |         NAME          |      NETWORK ID      | ROUTE TABLE ID |     ZONE      |      RANGE      |
+----------------------+-----------------------+----------------------+----------------+---------------+-----------------+
| b0c6n43f9lgh3695v2k2 | default-ru-central1-c | enpe3m3fa00udao8g5lg |                | ru-central1-c | [10.130.0.0/24] |
| e2l2da8a20b33g7o73bv | default-ru-central1-b | enpe3m3fa00udao8g5lg |                | ru-central1-b | [10.129.0.0/24] |
| e9bnlm18l70ao30pvfaa | default-ru-central1-a | enpe3m3fa00udao8g5lg |                | ru-central1-a | [10.128.0.0/24] |
+----------------------+-----------------------+----------------------+----------------+---------------+-----------------+

      5. Create a VM in the default folder. Specify the following parameters:

        • name: VM name.

          Note

          The VM name is used to generate the FQDN only once, when creating the VM. If the FQDN is important to you, choose an appropriate name for the VM at the creation stage.

        • zone: Availability zone that corresponds to the selected subnet.

        • subnet-name: Name of the selected subnet.

        • image-family: Family of images, for example, centos-7. This option lets you install the latest version of the operating system from the specified family.

        • Public IP. To create a VM without a public IP address, disable the nat-ip-version=ipv4 option.

        • ssh-key: Path to the public SSH key. The user yc-user will be automatically created on the VM for this key.

        • service-account-name: The name of the service account created in the previous step.

        yc compute instance create \
  --name first-instance \
  --zone ru-central1-a \
  --network-interface subnet-name=default-ru-central1-a,nat-ip-version=ipv4 \
  --create-boot-disk image-folder-id=standard-images,image-family=centos-7 \
  --ssh-key ~/.ssh/id_rsa.pub
  --service-account-name service-acc

        This creates a VM named first-instance.

      Create a VM using the method Create for the Instance resource:

      1. Prepare the key pair (public and private keys) for SSH access to the VM.

      2. Get an IAM token for authenticating in the examples:

      3. Get the ID of the folder.

      4. Get information about the image to create your VM from (image ID and minimum disk size):

        • If you know the image family, get information about the latest image in this family:

          export IAM_TOKEN=CggaATEVAgA...
export FAMILY=ubuntu-1804
curl -H "Authorization: Bearer ${IAM_TOKEN}" \
  "https://compute.api.cloud.yandex.net/compute/v1/images:latestByFamily?folderId=standard-images&family=${FAMILY}"

        • To learn more about the image, see the list of public images.

      5. Get the subnet ID and availability zone ID. Specify the ID of the folder where the subnet was created in your request:

        export IAM_TOKEN=CggaATEVAgA...
export FOLDER_ID=b1gvmob95yysaplct532
curl -H "Authorization: Bearer ${IAM_TOKEN}" \
  "https://vpc.api.cloud.yandex.net/vpc/v1/subnets?folderId=${FOLDER_ID}"
{
  "subnets": [
  {
    "v4CidrBlocks": [
      "10.130.0.0/24"
    ],
  "id": "b0c6n43ftldh30l0vfg2",
  "folderId": "b1gvmob95yysaplct532",
  "createdAt": "2018-09-23T12:15:00Z",
  "name": "default-ru-central1-c",
  "description": "Auto-created default subnet for zone ru-central1-c",
  "networkId": "enpe3m3fagludao8aslg",
  "zoneId": "ru-central1-c"
  },
  ...
]}

      6. Create a file where the body contains your request for VM creation (for example, body.json). Specify the following parameters:

        • folderId: ID of the folder.
        • name: Name to be assigned to the VM when it's created.
        • zoneId: Availability zone that corresponds to the selected subnet.
        • platformId: The platform.
        • resourceSpec: Resources available to the VM. The values must match the selected platform.
        • metadata: In the metadata, pass the public key for accessing the VM via SSH. For more information, see VM instance metadata.
        • bootDiskSpec: Boot disk settings. Specify the ID of the selected image and disk size. The disk size must not be below the minimum value specified in the image details.
        • networkInterfaceSpecs: Network settings.

          • subnetId: ID of the selected subnet.

          • primaryV4AddressSpec: IP address to be assigned to the VM. To add a public IP address to your VM, specify:

            "primaryV4AddressSpec": {
  "oneToOneNatSpec": {
    "ipVersion": "IPV4"
  }
}
        • serviceAccountId: ID of the service account created in the previous step.

        Read more about the request body format in the API reference.

        Example body.json file:

        {
  "folderId": "b1gvmob95yysaplct532",
  "name": "instance-demo-no-pwauth",
  "zoneId": "ru-central1-c",
  "platformId": "standard-v1",
  "resourcesSpec": {
    "memory": "2147483648",
    "cores": "2"
  },
  "metadata": {
    "user-data": "#cloud-config\nusers:\n  - name: user\n    groups: sudo\n    shell: /bin/bash\n    sudo: ['ALL=(ALL) NOPASSWD:ALL']\n    ssh-authorized-keys:\n      - ssh-rsa AAAAB3N... user@example.com"
  },
  "bootDiskSpec": {
    "diskSpec": {
      "size": "2621440000",
      "imageId": "fd8rc75pn12fe3u2dnmb"
    }
  },
  "networkInterfaceSpecs": [
    {
      "subnetId": "b0c6n43ftldh30l0vfg2",
      "primaryV4AddressSpec": {
        "oneToOneNatSpec": {
          "ipVersion": "IPV4"
        }
      }
    }
  ],
  "serviceAccountId": "ajelabcde12f33nol1v5"
}

      7. Create a VM:

        export IAM_TOKEN=CggaATEVAgA...
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer ${IAM_TOKEN}" \
  -d '@body.json' \
  https://compute.api.cloud.yandex.net/compute/v1/instances

    3. Add variables for convenience:

      • Public IP address of your VM to the variable ${PUBLIC_IP}:

        export PUBLIC_IP=<user_name>@<public_IP-address_of_VM>

      • Registry ID from the example in the ${REGISTRY_ID} variable:

        export REGISTRY_ID=crpc9qeoft236r8tfalm

    4. Log in to the registry under your username:

      1. If you don't have an OAuth token, get one via link.

      2. Run the command:

        echo <oauth_token> | docker login --username oauth --password-stdin cr.yandex

        Command results:

        Login Succeeded

      Note

      The IAM token has a short lifetime — no more than 12 hours. That's why this is a good method for applications that automatically request an IAM token.

      1. Get IAM token.

      2. Run the command:

        yc iam create-token | docker login --username iam --password-stdin cr.yandex

        Command results:

        Login Succeeded

      1. If you don't have a YC CLI profile yet, create one.

      2. Configure Docker to use docker-credential-yc:

        yc container registry configure-docker

        Command results:

        Credential helper is configured in '/home/<user>/.docker/config.json'

        Settings are saved in the current user's profile.

        Warning

        The Credential helper only works when using Docker without sudo. For information about how to configure Docker to run as the current user without using the sudo command, see the official documentation.

      3. Make sure that Docker is configured.

        The /home/<user>/.docker/config.json file must contain the following line:

        "cr.yandex": "yc"

      4. You can now use Docker, for example, to push Docker images. You don't need to run docker login for that.

    5. Create a file named Dockerfile and add the following lines to it:

      FROM ubuntu:latest
CMD echo "Hi, I'm inside"

    6. Build a Docker image:

      docker build . -t cr.yandex/${REGISTRY_ID}/ubuntu:hello

    7. Push the created Docker image to Yandex Cloud Registry:

      docker push cr.yandex/${REGISTRY_ID}/ubuntu:hello

      Command results:

      The push refers to repository [cr.yandex/crpc9qeoft236r8tfalm/ubuntu]
cc9d18e90faa: Pushed
0c2689e3f920: Pushed
47dde53750b4: Pushed
hello: digest: sha256:42068479274f1d4c7ea095482430dcba24dcfe8c23ebdf6d32305928e55071cf size: 943

    8. Log in to the VM via SSH and authenticate as the service account associated with this VM:

      ssh ${PUBLIC_IP} \
curl -H Metadata-Flavor:Google 169.254.169.254/computeMetadata/v1/instance/service-accounts/default/token | cut -f1 -d',' | cut -f2 -d':' | tr -d '"' | sudo docker login --username iam --password-stdin cr.yandex

      Command results:

      Login Succeeded

    9. Pull the Docker image to the VM:

      ssh ${PUBLIC_IP} docker pull cr.yandex/${REGISTRY_ID}/ubuntu:hello

      Command results:

      hello: Pulling from crpc9qeoft236r8tfalm/ubuntu
6a5697faee43: Pulling fs layer
ba13d3bc422b: Pulling fs layer
a254829d9e55: Pulling fs layer
a254829d9e55: Verifying Checksum
a254829d9e55: Download complete
ba13d3bc422b: Verifying Checksum
ba13d3bc422b: Download complete
6a5697faee43: Download complete
6a5697faee43: Pull complete
ba13d3bc422b: Pull complete
a254829d9e55: Pull complete
Digest: sha256:42068479274f1d4c7ea095482430dcba24dcfe8c23ebdf6d32305928e55071cf
Status: Downloaded newer image for cr.yandex/crpc9qeoft236r8tfalm/ubuntu:hello
cr.yandex/crpc9qeoft236r8tfalm/ubuntu:hello

    10. Run the Docker image on the VM:

      ssh ${PUBLIC_IP} docker run cr.yandex/${REGISTRY_ID}/ubuntu:hello

      Command results:

      Hi, I'm inside
    Language / Region
    © 2021 Yandex.Cloud LLC