Encrypting docker images (end to end); transporting over offline channels We are developing and building docker images in our intranet, and need to deploy them to several hosts belonging to us (developers, internal testing, external testing and so on). Some of these are in our intranet, some are accessible for 3rd parties on the internet.

The final deployment is inside the customer's intranet on several nodes (production, different test stages). These are behind firewalls that don't regularly let them access things outside their intranet, i.e., while some of them can be allowed to access an external registry for deployment, others can't and images have to be delivered manually through some arcane software upload tool.

I am looking for a way to have a registry on the internet (possibly ran by ourselves on some VM out there, preferably not) which allows the images to be stored encrypted (preferably GPG or similar, not a simple password). But then also being able to rather simply delivering "half" of the stuff via some upload mechanism manually. The customer is very paranoid, so keeping the end-to-end-encryption up is quite important.

Is there a tool that springs to mind, which is perfectly able to handle it? One solution would be to mirror the full registry to the customer premises on a dedicated host, keeping the encryption part intact.

A "standard" solution would be great, I'd be loath to hack something together if there is something lean/lightweight/established/stable around, already.

EDIT (+edit to the title): An extensive permission scheme like the one offered by Portus is a good start, but I am looking ideally for end-to-end encryption of the actual images. The customer is ultra paranoid and just getting started with Docker, cloud-based services etc.
Google Container Registry is a potential option.


Registry is private
Image layers are stored on a Google Cloud Storage bucket, which is encrypted by Google (RSA) and can be additionally encrypted with a client key (RSA)
Access control is granular down to each individual object stored on GCS bucket
Client-side authentication is enforced via oauth2. Clients configure docker to use the google cloud sdk as a credentials manager
Images are pulled via ssl connections


The fact that the registry is part of Google's Cloud Platform also means you can build up to some other interesting things. For example, you could set up a VM to serve as reverse-proxy and set up the GCP firewall to only allow 443 from a certain set of IPs (like your clients' offices).