如何配置Docker Desktop的K8s通过Artifactory代理拉取镜像

组织规定所有公共仓库（如Docker Hub、GCR）的Docker镜像必须通过私有Artifactory服务（mirror.company.com）代理，直接使用Docker命令或Dockerfile时只需添加前缀即可。但使用Docker Desktop内置的Kubernetes部署厂商Helm Chart时，因Chart中直接引用了公共仓库镜像（如docker.io/kong/gateway-operator:1.2、gcr.io/kubebuilder/kube-rbac-proxy:v0.8.0），导致镜像拉取失败，报错显示公共仓库访问被管理员限制：

% kubectl -n kong-system get pods                                                    
NAME                                                       READY   STATUS             RESTARTS   AGE
kgo-gateway-operator-controller-manager-7b84447bb6-wnw7v   0/2     ImagePullBackOff   0          22m
% kubectl -n kong-system describe pods kgo-gateway-operator-controller-manager-7b84447bb6-wnw7v
Name:             kgo-gateway-operator-controller-manager-7b84447bb6-wnw7v
Namespace:        kong-system
...
Events:
  Type     Reason     Age                   From               Message
  ----     ------     ----                  ----               -------
  Normal   Scheduled  23m                   default-scheduler  Successfully assigned kong-system/kgo-gateway-operator-controller-manager-7b84447bb6-wnw7v to docker-desktop
  Warning  Failed     23m (x2 over 23m)     kubelet            Error: ErrImagePull
  Warning  Failed     23m (x2 over 23m)     kubelet            Error: ImagePullBackOff
  Normal   BackOff    23m (x2 over 23m)     kubelet            Back-off pulling image "gcr.io/kubebuilder/kube-rbac-proxy:v0.8.0"
  Warning  Failed     23m (x2 over 23m)     kubelet            Error: ImagePullBackOff
  Normal   Pulling    22m (x3 over 23m)     kubelet            Pulling image "docker.io/kong/gateway-operator:1.2"
  Warning  Failed     22m (x3 over 23m)     kubelet            Failed to pull image "docker.io/kong/gateway-operator:1.2": Error response from daemon: Get "https://registry-1.docker.io/v2/": Access to registry-1.docker.io has been restricted by your administrators. To access this registry, ask your administrators to add it to your organization's allowed registries.
  Warning  Failed     22m (x3 over 23m)     kubelet            Error: ErrImagePull
  Normal   Pulling    22m (x3 over 23m)     kubelet            Pulling image "gcr.io/kubebuilder/kube-rbac-proxy:v0.8.0"
  Warning  Failed     22m (x3 over 23m)     kubelet            Failed to pull image "gcr.io/kubebuilder/kube-rbac-proxy:v0.8.0": Error response from daemon: Get "https://gcr.io/v2/": Access to gcr.io has been restricted by your administrators. To access this registry, ask your administrators to add it to your organization's allowed registries.
  Normal   BackOff    3m23s (x89 over 23m)  kubelet            Back-off pulling image "docker.io/kong/gateway-operator:1.2"

可行的解决方法 #

1. 配置Docker Desktop全局镜像仓库镜像 #

Docker Desktop支持全局镜像代理设置，让所有镜像拉取请求自动转发到Artifactory，无需修改镜像引用：

• 打开Docker Desktop设置，进入Docker Engine选项卡
• 在配置JSON中添加registry-mirrors字段：

  {
    "registry-mirrors": ["https://mirror.company.com"]
  }
  

• 点击Apply & Restart重启Docker Desktop，确保Kubernetes节点同步生效

注意：需确认Artifactory已配置Docker Hub、GCR等公共仓库的远程代理，否则无法正常转发请求。

2. 直接修改Kubernetes节点的Docker配置 #

如果全局配置不生效，可手动修改Docker Desktop的Kubernetes节点配置：

• 进入Kubernetes节点容器：

  docker exec -it docker-desktop sh
  

• 编辑/etc/docker/daemon.json，添加相同的registry-mirrors配置
• 重启Docker服务：

  systemctl restart docker
  

3. 用Helm参数批量替换镜像前缀（无需修改Chart） #

如果全局配置有障碍，可在安装Chart时通过--set参数直接覆盖镜像仓库地址：

helm install kgo kong/gateway-operator \
  --namespace kong-system \
  --set image.repository=mirror.company.com/kong/gateway-operator \
  --set kubeRbacProxy.image.repository=mirror.company.com/kubebuilder/kube-rbac-proxy

需提前查看Chart的values.yaml文件，确认镜像相关的配置路径。

4. 配置Artifactory虚拟仓库 #

让Artifactory创建一个虚拟仓库，整合所有需要的公共仓库代理（Docker Hub、GCR等），这样全局镜像镜像配置就能统一指向这个虚拟仓库地址，无需区分不同公共仓库的路径。

内容的提问来源于stack exchange，提问作者ShawnC