anchor.diff:  ====
   See xref:registry-known-issues[Known Issues] if using a scaled registry with a
   shared NFS volume.
  +====
  +
  +[[registry-amazon-s3-storage-back-end]]
  +===== Use Amazon S3 as a Storage Back-end
  +
  +There is also an option to use Amazon Simple Storage Service storage with the
  +internal Docker registry. It is a secure cloud storage manageable through
  +link:https://aws.amazon.com/s3/getting-started/[AWS Management Console]. To use
  +it, the registry's configuration file must be manually edited and mounted to
  +the registry pod. However, before you start with the configuration, look at
  +upstream's
  +link:https://docs.docker.com/docker-trusted-registry/configure/config-storage/#amazon-s3[recommended
  +steps].
  +
  +Take a xref:docker-registry-deploying-updated-configuration[default YAML
  +configuration file] as a base and replace the *filesystem* entry in the
  +*storage* section with *s3* entry such as below. The resulting storage section
  +may look like this:
  +
  +====
  +[source,yaml]
  +----
  +storage:
  +  cache:
  +    layerinfo: inmemory
  +  delete:
  +    enabled: true
  +  s3:
  +    accesskey: awsaccesskey
  +    secretkey: awssecretkey
  +    region: us-west-1
  +    regionendpoint: http://myobjects.local
  +    bucket: bucketname
  +    encrypt: true
  +    keyid: mykeyid
  +    secure: true
  +    v4auth: false
  +    chunksize: 5242880
  +    rootdirectory: /s3/object/name/prefix
  +----
  +====
  +
  +All of the *s3* configuration options are documented in upstream's
  +link:https://docs.docker.com/registry/storage-drivers/s3/[driver reference
  +documentation].
  +
  +xref:advanced-overriding-the-registry-configuration[Overriding the registry
  +configuration] will take you through the additional steps on mounting the
  +configuration file into pod.
  +
  +[WARNING]
  +====
  +When the registry runs on the S3 storage back-end, there are
  +xref:known-issue-s3-image-push-fails[reported issues].
   ====
   
   [[registry-non-production-use]]
  
positive.code: ----
  $ oc tag srcimagestream:latest anyproject/pullimagestream:latest
  ----
  ====
  
  And subsequently pulling from it, using an image reference such as:
  
  ====
  ----
  internal.registry.url:5000/anyproject/pullimagestream:latest
  ----
  
negative.code: To prevent this, avoid the tagging of internally managed images completely, or
  re-push the built image to the desired namespace
  xref:access-pushing-and-pulling-images[manually].
  
  [[known-issue-s3-image-push-fails]]
  ==== Image Push fails with `500 Internal Server Error` on S3 storage
  
  There are problems reported happening when the registry runs on S3 storage
  back-end. Pushing to a Docker registry occasionally fails with the following
  error:
  
  ----
  Received unexpected HTTP status: 500 Internal Server Error
  ----
  
  To debug this, you need to link:#viewing-logs[view the registry logs]. In there,
  look for similar error messages occurring at the time of the failed push:
  
  ----
  time="2016-03-30T15:01:21.22287816-04:00" level=error msg="unknown error completing upload: driver.Error{DriverName:\"s3\", Enclosed:(*url.Error)(0xc20901cea0)}" http.request.method=PUT
  ...
  time="2016-03-30T15:01:21.493067808-04:00" level=error msg="response completed with error" err.code=UNKNOWN err.detail="s3: Put https://s3.amazonaws.com/oso-tsi-docker/registry/docker/registry/v2/blobs/sha256/ab/abe5af443833d60cf672e2ac57589410dddec060ed725d3e676f1865af63d2e2/data: EOF" err.message="unknown error" http.request.method=PUT
  ...
  time="2016-04-02T07:01:46.056520049-04:00" level=error msg="error putting into main store: s3: The request signature we calculated does not match the signature you provided. Check your key and signing method." http.request.method=PUT
  atest
  ----
  
  If you see such errors, contact your Amazon S3 support. There may be a
  problem in your region or with your particular bucket.
  
  [[registry-whats-next]]
  == What's Next?
  