Connect through Cloudflare Access using docker

Cloudflare’s Zero Trust platform offers a secure way to connect to Docker registries by using its cloudflared tool. This setup ensures that your connections are authenticated, private, and protected from unauthorized access. Here’s how you can achieve this.

Overview

This guide covers:

Building a policy in Cloudflare Access to secure your Docker registry
Setting up a connection between Cloudflare and your Docker registry
Connecting to the Docker registry from a client machine

Prerequisites

A website added to Cloudflare.
A Docker registry you want to secure.
cloudflared installed on both the server and client machines.
Administrative access to Cloudflare Zero Trust.

Step 1: Create a Zero Trust Policy

To secure your Docker registry, you first need to create an application in Cloudflare Zero Trust.

Log in to the Cloudflare Zero Trust dashboard.
Navigate to Applications and click Add an application.
Select Self-hosted as the application type.
Under Application Domain, input a subdomain where your Docker registry will be accessible (e.g., registry.domain.com).
Set up rules to specify which users or groups can access the registry. For example:
- Allow specific emails (e.g., devops@domain.com).
- Use SSO authentication methods such as Google or Azure AD.
Click Save to finalize your policy.

Step 2: Install and Authenticate Cloudflared

Cloudflare Tunnel, powered by the lightweight cloudflared daemon, establishes a secure outbound connection between your server and Cloudflare’s network. Follow these steps:

Install cloudflared on the server hosting the Docker registry by following the installation instructions.
Authenticate cloudflared to connect it with your Cloudflare account:
```
cloudflared tunnel login
```
This command opens a browser window to log in. If you’re on a headless server, copy the URL output and open it in any browser.

Step 3: Create and Configure a Tunnel

Create a new tunnel to connect your Docker registry:
```
cloudflared tunnel create docker-registry
```
This generates a unique tunnel ID and a credentials file.

Configure the tunnel by creating a YAML file, typically located at ~/.cloudflared/config.yml. Replace the example values with your tunnel ID and registry domain:

tunnel: <tunnel-id>
credentials-file: /root/.cloudflared/<tunnel-id>.json

ingress:
  - hostname: registry.domain.com
    service: tcp://127.0.0.1:32000
  - service: http_status:404

Add a DNS record in the Cloudflare dashboard to route traffic to your tunnel:
- Type: CNAME
- Name: registry (or your subdomain prefix)
- Target: <tunnel-id>.cfargotunnel.com
Start the tunnel:
```
cloudflared tunnel run docker-registry
```

Step 4: Connect from a Client Machine

Install cloudflared on your client machine. On macOS, you can use Homebrew:
```
brew install cloudflared
```
Create a connection to the Docker registry. Replace the example values with your registry domain and a local port:
```
cloudflared access tcp --hostname registry.domain.com --url 127.0.0.1:32000
```

Or use a service token instead of SSO for automations in CI/CD:

cloudflared access tcp --hostname registry.domain.com --url 127.0.0.1:32000 \
  --service-token-id CF_ACCESS_CLIENT_ID \
  --service-token-secret CF_ACCESS_CLIENT_SECRET

With the connection running, use Docker commands to interact with the registry. For example:
```
docker push 127.0.0.1:32000/image:latest
```

Cloudflare will handle the authentication process, launching a browser window or using the service token for access.

For more details, you can refer to the official Cloudflare documentation for kubectl.

Share article

By @WhoAmI

CEO & Co-Founder