[MUSIC]
Hi, I'm Scott Hanselman, it's another episode of Azure Friday,
I'm here with Steve and
we're talking about the Azure container registry, GAs.
>> Yeah, yeah, we've got it now,
general availability, so people can start putting their
production loads on it, and >> It's been quite fun as our own
internal team start to put load on it.
>> Mm-hm.
>> We got to watch how many people are pushing and pulling.
Turns up there's a lot of activity that goes on to a registry.
>> Okay, so what is a registry and why do I need it?
>> So, probably the best way to help there is
we kinda talk about this workflow here.
People are working in developing in a loop.
Even in that inner loop when they're starting to build their first Docker
images, where do you get your image from?
>> Hm.
>> Right, it might be a public one you have on Docker hub.
>> Right, your base image, yeah.
>> Your base image.
Or, I might as a company have decided that we have our own content
that we wanna put in that image and I don't want it public.
>> Mm-hm.
>> Right, think of GitHub Enterprise or
the other kinda places- >> Sure.
>> Where I wanna keep things inside.
So, we can stand up a private registry in Azure.
You can then control it with your AD credentials, so
you can limit to your team.
And then even for you base poles, you can pull your own image.
But certainly, when you're doing your builds,
you can push to that registry and it works right in your own data center,
wherever your data center of choice is.
So, in fact, we have some new data centers we've announced.
>> So, Steve, I understand this
in the context of maybe what people already understand.
If you make new Git packages or NPM packages,
you'll pull from a bunch of open-source sources like nuget.org.
>> Right. >> But
when you make your final product, secret magic startup product,
you're gonna put on MyGet or some private enterprise,
hardened secured location.
This is where the results of my build
live in that, >> Correct.
>> My container register and I control it.
It is my instance.
You control who has access to it.
It's what I call, network close.
So when you're doing your builds, you probably want your build agent
network close to that in the same data center.
So things just run faster, and so they're secure,
it's faster, then you can deploy into your resources as well.
>> And this isn't a shared resource, this is mine, right?
Other people who are nearby are not in there with me?
>> Right, this is, you will do a look at it and
you will only see your images.
>> Fantastic.
>> So why don't we take a look at some of that.
And actually, what's interesting here also is, and
this is what's just cool about Azure,
is containers are becoming just everywhere.
When we first did .NET, it was like okay, here's the .NET console,
here's the .NET web app, and then how long was it before .NET was in
every technology >> Sure.
>> That we talked about.
And we're seeing that with the registry, or containers, as well.
Containers have become the unit of deployment, so
you need a place to actually store your images.
>> It's interesting that you say that because for many years,
I have said that Git was FTP for code.
Now, in fact, Docker and containers in general, it's becoming FTP for
your implementation, for your instance.
>> For your code and the environment, so
you can deploy it all.
>> It's the better way to move instances around.
I'd like to point out here,
you can run them in a number of different ways.
>> Right.
So I want you to take a look at what we can do here.
So we'll go to the portal and we'll wanna do a new registry.
So we'll just kinda go it this way so
people know where to find it if it doesn't show up in their MRU.
So we have the Azure container registry here and
we can create a new one.
And we've got the blade here, and we can give it some names,
twestissyfriday for instance.
And we will get a little validation glib that says,
is that name globally unique?
Which apparently, let's try that one again.
>> Is this going on to a VM or is this software as a service?
Do I have to think about that?
What am I paying for?
>> Yeah, that's great.
This is software as a service.
So we are hosting the registry.
You will just see it as an endpoint.
There'll be for now in the GA release right now,
there actually is a storage account in your subscription and
that's what we actually bill on.
We will be moving to managed storage where you won't even see that in
your subscription.
>> Nice.
>> So we've as typical database things,
we see people kind of going at the storage account directly.
They're deleting it, they're messing with it and
then they wonder why their registry doesn't work.
So we're gonna help them with those kind of management ways.
But for now you will see that in your account.
>> What I like about this is that it comes down to storage.
You pay for the storage and that's intuitive.
That makes sense to me.
If I am pushing once a week, then I'll pay for that amount of storage.
But if I'm doing CIDC and I'm pushing hourly,
then I'll certainly pay more.
>> Exactly. >> Seems like a smart pricing model.
>> Exactly.
>> So here you see we have quite a few regions.
This is part of going GA is we can go down to Australia.
We can go to Canada, Japan, Northern Europe, wherever we want.
And so, let's just, I don't know, let's choose West Europe here for
the sake of it.
And we'll go off and create that.
Now I did turn on the admin.
We'll show that when it comes up.
So that's starting to provision and if I take a look at the container
registries, we can see the ones that we already have here.
And, we'll just zoom this up a little bit, and
you can see I already had one in India, the one in Australia,
put a little kiwi thing in there, and I do-
>> Do they have UIs?
Do they have front ends?
>> Nice that you asked.
So, yes, we do.
One of the things that we added just recently,
because this is one of the things that people were asking,
was how can I see in my list of images that I have in my repository.
So now, we have a repository listing.
And you can see the different ones that I have there.
>> So a registry contains repositories and
repositories contain images that are tagged?
>> Correct, so
you'll also notice that I have a couple of nestings there.
So instead of a single nesting,
I could actually create multiple nesting.
So you might have your team,
the bite sharing team was one of the demos we did recently.
You might have the POC and you might have the web, and the API.
And you might have the production version of it.
You might have another team working on a whole other project and
you can just keep on nesting them down.
>> Okay, so I can partition those any way I want.
So, one registry, one set of repositories can then be
managed with access control however I want.
>> Yup. >> If I wanted to
change my access control in some dramatic way,
each group in my company could have multiple registries.
>> Right. >> Totally up to me.
And so we also have the command line of it.
So let's kind of show how some of that can be done there.
So here I'll give you, that's what I was doing here.
So Azure Friday, we'll create this one here.
This is using the AZCLI.
>> So you're doing the same thing you did in the portal except now
you're doing it at the command line.
>> Right.
>> I'm use to Azure VM Create.
>> And Azure App Service create,
you're doing it Azure container registry create.
>> Correct.
>> So it's intuitive, I already know how to make stuff or list stuff or
delete stuff, I can do the same thing.
>> Right, and here we're focused on the Azure V2 CLI for the AZ CLI,
so we'll see that go off in- >> Yeah,
and I did some videos recently that people can check out to show you how
to use Docker to bring down the Azure CLI Docker container, and
>> You don't have to set up Python
on your Windows machine.
You can just run that in Docker right away which is pretty slick.
>> Yeah, that's another example of where Docker was just being used as
the scene of the deployment.
>> Indeed.
>> So if we come over to the portal, we will see our registries.
Let's kind of come back over here and
we'll look at all of our registries that are created.
>> See there are some of the ones you just made. Yeah.
>> Yeah, so
let's see if this one's done.
All right, so let that one finish a little bit, but
now we've got a registry.
We want to push something to it, so that's one of the things that we
need to figure out so that the first thing you would need to do is, well,
if I'm going to tag and push an image to it, well,
I need to be authenticated to it.
>> Right.
>> So normally when you see a registry when you're doing pulls and
pushes, you just kinda say I want ASP.NET Core or
Microsoft/ASP.NET Core, right.
Docker assumes if you don't specify that it's gonna go up to docker hub.
>> Right, when you see a moniker ESP net core EPS net core
build it's assuming the public registry.
>> Right.
>> Okay. >> In this case I wanna redirect it
to a private registry and that's what I can do here.
So actually what I showed a moment ago if you remember,
I showed the admin stuff.
So lets go and grab this one let's just say.
>> And I can go to the access keys here.
Actually, let me go grab a different one.
Let's go grab the Canadian one here for a second.
Notice we actually have some rotation keys here, so
I can use either one of these.
This one is kind of a special privileged one,
because there's really only one account.
And we do have rotating keys.
What we probably want is one that you can do permissions on, owners,
read only, so on and so forth.
>> Yeah, I don't wanna share a super user with everyone.
>> Exactly, so what we've done is we used the service principle model
here and we've,
after the register is created, we've given you that snippet.
>> That you could run.
And it is kind of long so I will go paste it over here in Notepad.
>> Sure, it is long but it is written for you and
you're basically gonna go and make create for RBAC,
roll based access control, a new role with a password.
>> So we'll just kind of do that.
>> Highly secure.
>> Yeah which we'll delete very quickly.
[LAUGH] So we'll go off and now create that service principle.
And you can see the scope and all of that for that registry.
And notice the role is owner.
So in this case, but I could've also,
obviously done it as a different role.
>> Mm-hm.
>> And the list of roles are on the docs there.
So that'll give me the ability to have a username and password.
>> Mm-hm. >> And you kind of see the app ID
is the username.
>> Right. >> So I can use that to login.
Now I need to log in to this newly created registry.
So we'll say docker login.
And the registry that we created here, what was it?
Stevelas Azure Friday.
>> Yeah.
>> So we'll do that.
And for the username, and I could've done a -u -p for you here, but-
>> Sure, of course,
you could've just done Steve or
whatever, but- >> We'll do that.
>> Someone is assigned their password and their information,
some password.
>> Thank you.
>> Someone is assigned that password, and they log in once, and
then they go about their business.
>> Right, so- >> So now you're in.
>> So now I'm in, so- >> Gosh, let me guess,
if you type Docker images,
you're not gonna see the same stuff as before.
Actually I would.
Remember, so Docker images is actually looking locally.
>> Okay. >> Right, it's the local cache in my
machine, so that's what's built against my local host here.
This is just saying that when,
I can log into a couple of registries, right?
I actually am logged into a couple.
>> Okay. >> But
now if I want to push images to it,
let's say I want to take this web image that I've got here.
And I just built this from one of our samples, and
you can see there's the web latest.
>> Sure.
>> So what I would do is docker tag web to be this URL.
Where is the name of our, here we go.
This one right here.
That.
>> Right. >> Slash web and
we'll just say version one.
>> Okay.
>> And now if I do docker images.
I have two of them >> So repository,
>> These are local.
That's a remote one.
You haven't pushed it yet thought, right?
>> No I haven't.
But also notice the image idea is the same, right?
It knows the only thing different is a tag.
>> Right.
>> So now what I can do is say docker push.
And it'll now push that one to that registry.
So what the Docker client knows,
and we didn't make any changes to the Docker client.
Notice I'm actually using all the Docker CLI.
>> So Docker doesn't know or care that you are talking to Azure?
>> Nope.
It just sees that URL.
Anything before the slash, it sees there's dots in it and
goes, that must be a domain.
>> Is it significant that it pushed all the layers?
Did it take layers of it it pulled down from the public one and
pushed it to the private ones.
>> Right. >> So that you have no dependencies.
>> Correct.
So now, I don't.
All those layers are actually in my registry at this point, so
that's kind of cool.
>> That is extremely cool.
>> So now, if I go over to the portal and
which one did I use, by the way?
I did the AZ Friday thing.
>> Uh-huh.
>> So, we'll come over here. To-
>> I think you did Stevelas, yeah,
you did this right.
We've got so many.
>> I know, trying to show locations.
And now we show repositories.
We should see oop, there's red, there's one.
In fact, if we make a change here.
Let's just kinda go over here and say Hello World.
Version two.
>> We'll go build that here.
>> Of course, you're doing this in VS, and VS knows about docker.
You can see the docker compose.
VS is calling the docker commands for you and building that image.
There it goes and boom.
>> Boom it's done.
So now, if I look at docker images, if I could spell it right.
Did you ever create that shortcut?
>> 313, no I didn't.
>> [LAUGH] >> I should do that.
There's 313, which we only just made.
>> So I need a tag, that docker tag >> [INAUDIBLE]
>> Web, let's grab latest and
make sure we're actually getting latest,
I don't know if I did that before.
And we'll call that two.
Okay, yep.
>> So now we tag that one and now all we'll do is push
this up to a container registry and notice layer exist, layer exist.
All those previous layers were already push as they're only had
a push the code difference for the last one.
And if we come over to the portal,
we should see, >> Web Azure C1-
>> That's what I meant to do.
Thank you.
>> There it is, what if you click on a tag, what happens?
>> You see manifests.
>> There is is. >> You see
all kinds of other gooey- >> All this stuff-
>> Details.
>> Yeah, the internals of what got stored.
>> Yeah, so it kind of looks like internals too, right.
>> So I can use this as a place I can push to myself,
as you did manually.
>> All that stuff that you did that was a poor man's CICD?
>> Correct. >> Visual Studio built it,
Docker built the image, you push the images,
that was what Visual Studio team services could go and do for us.
>> Correct.
>> And then now that you have that private registry but it's close to
your other Azure resources, you could then deploy that.
>> Right, very cool.
>> Pretty cool.
>> GA unavailable.
GA unavailable.
Get started today.
We'll have some new features coming as well,
which we're pretty excited about.
But this we wanted to get out and let people get started already.
>> Very cool.
We're learning all about the Azure container registry here on
Azure Friday.
[MUSIC]