Hosting a Docker image registry along with the dashboard/server

[parkeraddison]

Hi NVFlare users, do you have any thoughts around hosting a private Docker registry on the same machine used to host the dashboard or the FL Server?

I'm thinking when someone hosts the Dashboard or sets up the FL Server machine, they can also spin up a private Docker registry (https://docs.docker.com/registry/deploying/). That way, the project admin can push an image to this registry and provide a link to the private registry when it asks for the Docker download link in the application details tab of the dashboard.

Pretty sure it makes sense for a registry to be hosted on the dashboard/server machine because networking and security/firewalls should already be in place to allow all participants (servers, clients, users) to access the dashboard/server, and the registry can remain private. Let me know if this might not be a good idea!

This works when tested, except I was using an insecure registry since I hadn't set up TLS certs. Ideally it would be a secure registry.

What are your thoughts for hosting a private registry? Do you think there's any way to use the certs that are created by the dashboard/server already?

[kkersten]

This is a great way to manage distribution of containers to the FL clients, and we commonly see Dashboard and Server running on the same machine. There's no reason not to add a Docker registry.

I would probably use a separate set of certs for the registry, following the guide linked for secure deployment. The main reason is that you may want the registry to run persistently, across different Dashboard or FL Server deployments (which may generate a new set of certs). By decoupling these with separate certs for the registry, you can keep it running regardless of Dashboard or Server state.