In Kubernetes nodes which run `containerd`, how to pull the Docker image `vesoft/nebula-alpine:latest` from a custom Docker registry mirror?

[ytxmobile98]

I am about to deploy NebulaGraph on some Kubernetes instances in my corporate production clusters, which have no network access to the Docker Hub (but may possibly connect to other public/private registries), and use containerd containers as runtime. Part of the generated config is as follows, which cannot proceed due to network access problems:

image: vesoft/nebula-alpine:latest  # <-- This line doesn't work because of no network access
imagePullPolicy: ItNotPresent
name: dynamic-flags
resources: {}
terminationMessagePath: /dev/termination-log
terminationMessagePolicy: File
volumeMounts:
- mountPath: /metadata
  name: flags

How may I be able to get the Kubernetes nodes to work and pull from a custom registry mirror? Thanks.

[egasimov]

Hey 👋

Since the cluster doesn’t have access to Docker Hub, the simplest way to fix this is to mirror the image to an internal registry and update the image reference in your YAML.

For example:
1. From a machine that does have internet access:

docker pull vesoft/nebula-alpine:latest 
docker tag vesoft/nebula-alpine:latest registry.mycorp.com/nebula/nebula-alpine:latest
docker push registry.mycorp.com/nebula/nebula-alpine:latest 

2.	Then update your deployment:

image: registry.mycorp.com/nebula/nebula-alpine:latest
imagePullPolicy: IfNotPresent

(Also small typo there — it should be IfNotPresent, not ItNotPresent 🙂)

If you’re using containerd, you can also configure a registry mirror in /etc/containerd/config.toml so pulls to docker.io get redirected to your internal registry.

If the cluster is fully air-gapped, another option is to docker save the image and import it directly on each node with ctr -n k8s.io images import, then set imagePullPolicy: Never

Also — for production, I’d strongly recommend pinning a specific version instead of latest, especially when deploying NebulaGraph.

Hope that helps 👍