Merge branch 'docker-registry-view' into 'master'

Add container registry support

Tasks:

- [x] Merge docker/distribution authentication service: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/3787
- [x] Implement Docker Registry API
- [x] Show a list of docker images in GitLab
- [x] Remove registry repository on project deletion
- [x] Support project rename, move and namespace rename
- [x] Use token when connecting the registry
- [x] Allow to delete images from GitLab
- [x] Support pushing from GitLab CI (gitlab-ci-token / $CI_BUILD_TOKEN)
- [x] Support GitLab Runner pulling for public repositories
- [ ] Support GitLab Runner pulling for private repositories
- [x] Add tests for Docker Registry API
- [x] Add tests for a views
- [x] Make texts nicer
- [x] Implement a backup support

- [ ] Create administration documentation https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/4141
- [ ] Create user documentation

See merge request !4040

14 files changed, 465 insertions, 17 deletions

diff --git a/spec/features/container_registry_spec.rb b/spec/features/container_registry_spec.rb
new file mode 100644
index 00000000000..53b4f027117
--- /dev/null
+++ b/spec/features/container_registry_spec.rb
@@ -0,0 +1,44 @@
+require 'spec_helper'
+
+describe "Container Registry" do
+  let(:project) { create(:empty_project) }
+  let(:repository) { project.container_registry_repository }
+  let(:tag_name) { 'latest' }
+  let(:tags) { [tag_name] }
+
+  before do
+    login_as(:user)
+    project.team << [@user, :developer]
+    stub_container_registry_tags(*tags)
+    stub_container_registry_config(enabled: true)
+    allow(Auth::ContainerRegistryAuthenticationService).to receive(:full_access_token).and_return('token')
+  end
+
+  describe 'GET /:project/container_registry' do
+    before do
+      visit namespace_project_container_registry_index_path(project.namespace, project)
+    end
+
+    context 'when no tags' do
+      let(:tags) { [] }
+
+      it { expect(page).to have_content('No images in Container Registry for this project') }
+    end
+
+    context 'when there are tags' do
+      it { expect(page).to have_content(tag_name)}
+    end
+  end
+
+  describe 'DELETE /:project/container_registry/tag' do
+    before do
+      visit namespace_project_container_registry_index_path(project.namespace, project)
+    end
+
+    it do
+      expect_any_instance_of(::ContainerRegistry::Tag).to receive(:delete).and_return(true)
+
+      click_on 'Remove'
+    end
+  end
+end
diff --git a/spec/fixtures/container_registry/config_blob.json b/spec/fixtures/container_registry/config_blob.json
new file mode 100644
index 00000000000..1028c994a24
--- /dev/null
+++ b/spec/fixtures/container_registry/config_blob.json
@@ -0,0 +1 @@
+{"architecture":"amd64","config":{"Hostname":"b14cd8298755","Domainname":"","User":"","AttachStdin":false,"AttachStdout":false,"AttachStderr":false,"Tty":false,"OpenStdin":false,"StdinOnce":false,"Env":null,"Cmd":null,"Image":"","Volumes":null,"WorkingDir":"","Entrypoint":null,"OnBuild":null,"Labels":null},"container":"b14cd82987550b01af9a666a2f4c996280a6152e66873134fae5a0f223dc5976","container_config":{"Hostname":"b14cd8298755","Domainname":"","User":"","AttachStdin":false,"AttachStdout":false,"AttachStderr":false,"Tty":false,"OpenStdin":false,"StdinOnce":false,"Env":null,"Cmd":["/bin/sh","-c","#(nop) ADD file:033ab063740d9ff4dcfb1c69eccf25f91d88729f57cd5a73050e014e3e094aa0 in /"],"Image":"","Volumes":null,"WorkingDir":"","Entrypoint":null,"OnBuild":null,"Labels":null},"created":"2016-04-01T20:53:00.160300546Z","docker_version":"1.9.1","history":[{"created":"2016-04-01T20:53:00.160300546Z","created_by":"/bin/sh -c #(nop) ADD file:033ab063740d9ff4dcfb1c69eccf25f91d88729f57cd5a73050e014e3e094aa0 in /"}],"os":"linux","rootfs":{"type":"layers","diff_ids":["sha256:c56b7dabbc7aa730eeab07668bdcbd7e3d40855047ca9a0cc1bfed23a2486111"]}}
diff --git a/spec/fixtures/container_registry/tag_manifest.json b/spec/fixtures/container_registry/tag_manifest.json
new file mode 100644
index 00000000000..1b6008e2872
--- /dev/null
+++ b/spec/fixtures/container_registry/tag_manifest.json
@@ -0,0 +1 @@
+{"schemaVersion":2,"mediaType":"application/vnd.docker.distribution.manifest.v2+json","config":{"mediaType":"application/octet-stream","size":1145,"digest":"sha256:d7a513a663c1a6dcdba9ed832ca53c02ac2af0c333322cd6ca92936d1d9917ac"},"layers":[{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","size":2319870,"digest":"sha256:420890c9e918b6668faaedd9000e220190f2493b0693ee563ebd7b4cc754a57d"}]}
diff --git a/spec/lib/container_registry/blob_spec.rb b/spec/lib/container_registry/blob_spec.rb
new file mode 100644
index 00000000000..4d8cb787dde
--- /dev/null
+++ b/spec/lib/container_registry/blob_spec.rb
@@ -0,0 +1,61 @@
+require 'spec_helper'
+
+describe ContainerRegistry::Blob do
+  let(:digest) { 'sha256:0123456789012345' }
+  let(:config) do
+    {
+      'digest' => digest,
+      'mediaType' => 'binary',
+      'size' => 1000
+    }
+  end
+  
+  let(:registry) { ContainerRegistry::Registry.new('http://example.com') }
+  let(:repository) { registry.repository('group/test') }
+  let(:blob) { repository.blob(config) }
+
+  it { expect(blob).to respond_to(:repository) }
+  it { expect(blob).to delegate_method(:registry).to(:repository) }
+  it { expect(blob).to delegate_method(:client).to(:repository) }
+
+  context '#path' do
+    subject { blob.path }
+
+    it { is_expected.to eq('example.com/group/test@sha256:0123456789012345') }
+  end
+
+  context '#digest' do
+    subject { blob.digest }
+
+    it { is_expected.to eq(digest) }
+  end
+
+  context '#type' do
+    subject { blob.type }
+
+    it { is_expected.to eq('binary') }
+  end
+
+  context '#revision' do
+    subject { blob.revision }
+
+    it { is_expected.to eq('0123456789012345') }
+  end
+
+  context '#short_revision' do
+    subject { blob.short_revision }
+
+    it { is_expected.to eq('012345678') }
+  end
+
+  context '#delete' do
+    before do
+      stub_request(:delete, 'http://example.com/v2/group/test/blobs/sha256:0123456789012345').
+        to_return(status: 200)
+    end
+
+    subject { blob.delete }
+
+    it { is_expected.to be_truthy }
+  end
+end
diff --git a/spec/lib/container_registry/registry_spec.rb b/spec/lib/container_registry/registry_spec.rb
new file mode 100644
index 00000000000..2638401ae6e
--- /dev/null
+++ b/spec/lib/container_registry/registry_spec.rb
@@ -0,0 +1,28 @@
+require 'spec_helper'
+
+describe ContainerRegistry::Registry do
+  let(:path) { nil }
+  let(:registry) { described_class.new('http://example.com', path: path) }
+
+  subject { registry }
+
+  it { is_expected.to respond_to(:client) }
+  it { is_expected.to respond_to(:uri) }
+  it { is_expected.to respond_to(:path) }
+
+  it { expect(subject.repository('test')).to_not be_nil }
+
+  context '#path' do
+    subject { registry.path }
+
+    context 'path from URL' do
+      it { is_expected.to eq('example.com') }
+    end
+
+    context 'custom path' do
+      let(:path) { 'registry.example.com' }
+
+      it { is_expected.to eq(path) }
+    end
+  end
+end
diff --git a/spec/lib/container_registry/repository_spec.rb b/spec/lib/container_registry/repository_spec.rb
new file mode 100644
index 00000000000..e6d66b11e4e
--- /dev/null
+++ b/spec/lib/container_registry/repository_spec.rb
@@ -0,0 +1,65 @@
+require 'spec_helper'
+
+describe ContainerRegistry::Repository do
+  let(:registry) { ContainerRegistry::Registry.new('http://example.com') }
+  let(:repository) { registry.repository('group/test') }
+
+  it { expect(repository).to respond_to(:registry) }
+  it { expect(repository).to delegate_method(:client).to(:registry) }
+  it { expect(repository.tag('test')).to_not be_nil }
+
+  context '#path' do
+    subject { repository.path }
+
+    it { is_expected.to eq('example.com/group/test') }
+  end
+
+  context 'manifest processing' do
+    before do
+      stub_request(:get, 'http://example.com/v2/group/test/tags/list').
+        with(headers: { 'Accept' => 'application/vnd.docker.distribution.manifest.v2+json' }).
+        to_return(
+          status: 200,
+          body: JSON.dump(tags: ['test']),
+          headers: { 'Content-Type' => 'application/vnd.docker.distribution.manifest.v2+json' })
+    end
+
+    context '#manifest' do
+      subject { repository.manifest }
+
+      it { is_expected.to_not be_nil }
+    end
+
+    context '#valid?' do
+      subject { repository.valid? }
+
+      it { is_expected.to be_truthy }
+    end
+
+    context '#tags' do
+      subject { repository.tags }
+
+      it { is_expected.to_not be_empty }
+    end
+  end
+
+  context '#delete_tags' do
+    let(:tag) { ContainerRegistry::Tag.new(repository, 'tag') }
+
+    before { expect(repository).to receive(:tags).twice.and_return([tag]) }
+
+    subject { repository.delete_tags }
+
+    context 'succeeds' do
+      before { expect(tag).to receive(:delete).and_return(true) }
+
+      it { is_expected.to be_truthy }
+    end
+
+    context 'any fails' do
+      before { expect(tag).to receive(:delete).and_return(false) }
+
+      it { is_expected.to be_falsey }
+    end
+  end
+end
diff --git a/spec/lib/container_registry/tag_spec.rb b/spec/lib/container_registry/tag_spec.rb
new file mode 100644
index 00000000000..12cf91127ed
--- /dev/null
+++ b/spec/lib/container_registry/tag_spec.rb
@@ -0,0 +1,89 @@
+require 'spec_helper'
+
+describe ContainerRegistry::Tag do
+  let(:registry) { ContainerRegistry::Registry.new('http://example.com') }
+  let(:repository) { registry.repository('group/test') }
+  let(:tag) { repository.tag('tag') }
+  let(:headers) { { 'Accept' => 'application/vnd.docker.distribution.manifest.v2+json' } }
+
+  it { expect(tag).to respond_to(:repository) }
+  it { expect(tag).to delegate_method(:registry).to(:repository) }
+  it { expect(tag).to delegate_method(:client).to(:repository) }
+
+  context '#path' do
+    subject { tag.path }
+
+    it { is_expected.to eq('example.com/group/test:tag') }
+  end
+
+  context 'manifest processing' do
+    before do
+      stub_request(:get, 'http://example.com/v2/group/test/manifests/tag').
+        with(headers: headers).
+        to_return(
+          status: 200,
+          body: File.read(Rails.root + 'spec/fixtures/container_registry/tag_manifest.json'),
+          headers: { 'Content-Type' => 'application/vnd.docker.distribution.manifest.v2+json' })
+    end
+
+    context '#layers' do
+      subject { tag.layers }
+
+      it { expect(subject.length).to eq(1) }
+    end
+
+    context '#total_size' do
+      subject { tag.total_size }
+
+      it { is_expected.to eq(2319870) }
+    end
+
+    context 'config processing' do
+      before do
+        stub_request(:get, 'http://example.com/v2/group/test/blobs/sha256:d7a513a663c1a6dcdba9ed832ca53c02ac2af0c333322cd6ca92936d1d9917ac').
+          with(headers: { 'Accept' => 'application/octet-stream' }).
+          to_return(
+            status: 200,
+            body: File.read(Rails.root + 'spec/fixtures/container_registry/config_blob.json'))
+      end
+
+      context '#config' do
+        subject { tag.config }
+
+        it { is_expected.to_not be_nil }
+      end
+
+      context '#created_at' do
+        subject { tag.created_at }
+
+        it { is_expected.to_not be_nil }
+      end
+    end
+  end
+
+  context 'manifest digest' do
+    before do
+      stub_request(:head, 'http://example.com/v2/group/test/manifests/tag').
+        with(headers: headers).
+        to_return(status: 200, headers: { 'Docker-Content-Digest' => 'sha256:digest' })
+    end
+
+    context '#digest' do
+      subject { tag.digest }
+
+      it { is_expected.to eq('sha256:digest') }
+    end
+
+    context '#delete' do
+      before do
+        stub_request(:delete, 'http://example.com/v2/group/test/manifests/sha256:digest').
+          with(headers: headers).
+          to_return(status: 200)
+      end
+
+      subject { tag.delete }
+
+      it { is_expected.to be_truthy }
+    end
+  end
+end
diff --git a/spec/models/namespace_spec.rb b/spec/models/namespace_spec.rb
index 4074f966299..4e68ac5e63a 100644
--- a/spec/models/namespace_spec.rb
+++ b/spec/models/namespace_spec.rb
@@ -70,6 +70,20 @@ describe Namespace, models: true do
       allow(@namespace).to receive(:path).and_return(new_path)
       expect(@namespace.move_dir).to be_truthy
     end
+
+    context "when any project has container tags" do
+      before do
+        stub_container_registry_config(enabled: true)
+        stub_container_registry_tags('tag')
+
+        create(:empty_project, namespace: @namespace)
+
+        allow(@namespace).to receive(:path_was).and_return(@namespace.path)
+        allow(@namespace).to receive(:path).and_return('new_path')
+      end
+
+      it { expect { @namespace.move_dir }.to raise_error('Namespace cannot be moved, because at least one project has tags in container registry') }
+    end
   end
 
   describe :rm_dir do
diff --git a/spec/models/project_spec.rb b/spec/models/project_spec.rb
index f6e5b132643..60e1ec43f2b 100644
--- a/spec/models/project_spec.rb
+++ b/spec/models/project_spec.rb
@@ -634,11 +634,11 @@ describe Project, models: true do
       # Project#gitlab_shell returns a new instance of Gitlab::Shell on every
       # call. This makes testing a bit easier.
       allow(project).to receive(:gitlab_shell).and_return(gitlab_shell)
-    end
 
-    it 'renames a repository' do
       allow(project).to receive(:previous_changes).and_return('path' => ['foo'])
+    end
 
+    it 'renames a repository' do
       ns = project.namespace_dir
 
       expect(gitlab_shell).to receive(:mv_repository).
@@ -663,6 +663,17 @@ describe Project, models: true do
 
       project.rename_repo
     end
+
+    context 'container registry with tags' do
+      before do
+        stub_container_registry_config(enabled: true)
+        stub_container_registry_tags('tag')
+      end
+
+      subject { project.rename_repo }
+
+      it { expect{subject}.to raise_error(Exception) }
+    end
   end
 
   describe '#expire_caches_before_rename' do
@@ -772,4 +783,71 @@ describe Project, models: true do
       expect(project.protected_branch?('foo')).to eq(false)
     end
   end
+
+  describe '#container_registry_repository' do
+    let(:project) { create(:empty_project) }
+
+    before { stub_container_registry_config(enabled: true) }
+
+    subject { project.container_registry_repository }
+
+    it { is_expected.to_not be_nil }
+  end
+
+  describe '#container_registry_repository_url' do
+    let(:project) { create(:empty_project) }
+
+    subject { project.container_registry_repository_url }
+
+    before { stub_container_registry_config(**registry_settings) }
+
+    context 'for enabled registry' do
+      let(:registry_settings) do
+        {
+          enabled: true,
+          host_port: 'example.com',
+        }
+      end
+
+      it { is_expected.to_not be_nil }
+    end
+
+    context 'for disabled registry' do
+      let(:registry_settings) do
+        {
+          enabled: false
+        }
+      end
+
+      it { is_expected.to be_nil }
+    end
+  end
+
+  describe '#has_container_registry_tags?' do
+    let(:project) { create(:empty_project) }
+
+    subject { project.has_container_registry_tags? }
+
+    context 'for enabled registry' do
+      before { stub_container_registry_config(enabled: true) }
+
+      context 'with tags' do
+        before { stub_container_registry_tags('test', 'test2') }
+
+        it { is_expected.to be_truthy }
+      end
+
+      context 'when no tags' do
+        before { stub_container_registry_tags }
+
+        it { is_expected.to be_falsey }
+      end
+    end
+
+    context 'for disabled registry' do
+      before { stub_container_registry_config(enabled: false) }
+
+      it { is_expected.to be_falsey }
+    end
+  end
 end
diff --git a/spec/services/auth/container_registry_authentication_service_spec.rb b/spec/services/auth/container_registry_authentication_service_spec.rb
index 3ea252ed44f..6c9f56a4fba 100644
--- a/spec/services/auth/container_registry_authentication_service_spec.rb
+++ b/spec/services/auth/container_registry_authentication_service_spec.rb
@@ -5,19 +5,12 @@ describe Auth::ContainerRegistryAuthenticationService, services: true do
   let(:current_user) { nil }
   let(:current_params) { {} }
   let(:rsa_key) { OpenSSL::PKey::RSA.generate(512) }
-  let(:registry_settings) do
-    {
-      enabled: true,
-      issuer: 'rspec',
-      key: nil
-    }
-  end
   let(:payload) { JWT.decode(subject[:token], rsa_key).first }
 
   subject { described_class.new(current_project, current_user, current_params).execute }
 
   before do
-    allow(Gitlab.config.registry).to receive_messages(registry_settings)
+    stub_container_registry_config(enabled: true, issuer: 'rspec', key: nil)
     allow_any_instance_of(JSONWebToken::RSAToken).to receive(:key).and_return(rsa_key)
   end
 
@@ -57,6 +50,11 @@ describe Auth::ContainerRegistryAuthenticationService, services: true do
     end
   end
 
+  shared_examples 'an unauthorized' do
+    it { is_expected.to include(http_status: 401) }
+    it { is_expected.to_not include(:token) }
+  end
+
   shared_examples 'a forbidden' do
     it { is_expected.to include(http_status: 403) }
     it { is_expected.to_not include(:token) }
@@ -123,7 +121,7 @@ describe Auth::ContainerRegistryAuthenticationService, services: true do
         { offline_token: true }
       end
 
-      it_behaves_like 'a forbidden'
+      it_behaves_like 'an unauthorized'
     end
 
     context 'allow to pull and push images' do
@@ -164,6 +162,20 @@ describe Auth::ContainerRegistryAuthenticationService, services: true do
         end
       end
     end
+
+    context 'for project without container registry' do
+      let(:project) { create(:empty_project, :public, container_registry_enabled: false) }
+
+      before { project.update(container_registry_enabled: false) }
+
+      context 'disallow when pulling' do
+        let(:current_params) do
+          { scope: "repository:#{project.path_with_namespace}:pull" }
+        end
+
+        it_behaves_like 'a forbidden'
+      end
+    end
   end
 
   context 'unauthorized' do
@@ -172,7 +184,7 @@ describe Auth::ContainerRegistryAuthenticationService, services: true do
         { offline_token: true }
       end
 
-      it_behaves_like 'a forbidden'
+      it_behaves_like 'an unauthorized'
     end
 
     context 'for invalid scope' do
diff --git a/spec/services/projects/destroy_service_spec.rb b/spec/services/projects/destroy_service_spec.rb
index a5cb6f382e4..29341c5e57e 100644
--- a/spec/services/projects/destroy_service_spec.rb
+++ b/spec/services/projects/destroy_service_spec.rb
@@ -28,6 +28,29 @@ describe Projects::DestroyService, services: true do
     it { expect(Dir.exist?(remove_path)).to be_truthy }
   end
 
+  context 'container registry' do
+    before do
+      stub_container_registry_config(enabled: true)
+      stub_container_registry_tags('tag')
+    end
+
+    context 'tags deletion succeeds' do
+      it do
+        expect_any_instance_of(ContainerRegistry::Tag).to receive(:delete).and_return(true)
+
+        destroy_project(project, user, {})
+      end
+    end
+
+    context 'tags deletion fails' do
+      before { expect_any_instance_of(ContainerRegistry::Tag).to receive(:delete).and_return(false) }
+
+      subject { destroy_project(project, user, {}) }
+
+      it { expect{subject}.to raise_error(Projects::DestroyService::DestroyError) }
+    end
+  end
+
   def destroy_project(project, user, params)
     Projects::DestroyService.new(project, user, params).execute
   end
diff --git a/spec/services/projects/transfer_service_spec.rb b/spec/services/projects/transfer_service_spec.rb
index 06017317339..d5aa115a074 100644
--- a/spec/services/projects/transfer_service_spec.rb
+++ b/spec/services/projects/transfer_service_spec.rb
@@ -26,6 +26,17 @@ describe Projects::TransferService, services: true do
     it { expect(project.namespace).to eq(user.namespace) }
   end
 
+  context 'disallow transfering of project with tags' do
+    before do
+      stub_container_registry_config(enabled: true)
+      stub_container_registry_tags('tag')
+    end
+
+    subject { transfer_project(project, user, group) }
+
+    it { is_expected.to be_falsey }
+  end
+
   context 'namespace -> not allowed namespace' do
     before do
       @result = transfer_project(project, user, group)
diff --git a/spec/support/stub_gitlab_calls.rb b/spec/support/stub_gitlab_calls.rb
index b5ca34bc028..f73416a3d0f 100644
--- a/spec/support/stub_gitlab_calls.rb
+++ b/spec/support/stub_gitlab_calls.rb
@@ -25,6 +25,23 @@ module StubGitlabCalls
     allow_any_instance_of(Project).to receive(:builds_enabled?).and_return(false)
   end
 
+  def stub_container_registry_config(registry_settings)
+    allow(Gitlab.config.registry).to receive_messages(registry_settings)
+    allow(Auth::ContainerRegistryAuthenticationService).to receive(:full_access_token).and_return('token')
+  end
+
+  def stub_container_registry_tags(*tags)
+    allow_any_instance_of(ContainerRegistry::Client).to receive(:repository_tags).and_return(
+      { "tags" => tags }
+    )
+    allow_any_instance_of(ContainerRegistry::Client).to receive(:repository_manifest).and_return(
+      JSON.load(File.read(Rails.root + 'spec/fixtures/container_registry/tag_manifest.json'))
+    )
+    allow_any_instance_of(ContainerRegistry::Client).to receive(:blob).and_return(
+      File.read(Rails.root + 'spec/fixtures/container_registry/config_blob.json')
+    )
+  end
+
   private
 
   def gitlab_url
diff --git a/spec/tasks/gitlab/backup_rake_spec.rb b/spec/tasks/gitlab/backup_rake_spec.rb
index 05fc4c4554f..8aeb013eec6 100644
--- a/spec/tasks/gitlab/backup_rake_spec.rb
+++ b/spec/tasks/gitlab/backup_rake_spec.rb
@@ -21,7 +21,7 @@ describe 'gitlab:app namespace rake task' do
   end
 
   def reenable_backup_sub_tasks
-    %w{db repo uploads builds artifacts lfs}.each do |subtask|
+    %w{db repo uploads builds artifacts lfs registry}.each do |subtask|
       Rake::Task["gitlab:backup:#{subtask}:create"].reenable
     end
   end
@@ -65,6 +65,7 @@ describe 'gitlab:app namespace rake task' do
         expect(Rake::Task['gitlab:backup:uploads:restore']).to receive(:invoke)
         expect(Rake::Task['gitlab:backup:artifacts:restore']).to receive(:invoke)
         expect(Rake::Task['gitlab:backup:lfs:restore']).to receive(:invoke)
+        expect(Rake::Task['gitlab:backup:registry:restore']).to receive(:invoke)
         expect(Rake::Task['gitlab:shell:setup']).to receive(:invoke)
         expect { run_rake_task('gitlab:backup:restore') }.not_to raise_error
       end
@@ -122,7 +123,7 @@ describe 'gitlab:app namespace rake task' do
 
     it 'should set correct permissions on the tar contents' do
       tar_contents, exit_status = Gitlab::Popen.popen(
-        %W{tar -tvf #{@backup_tar} db uploads.tar.gz repositories builds.tar.gz artifacts.tar.gz lfs.tar.gz}
+        %W{tar -tvf #{@backup_tar} db uploads.tar.gz repositories builds.tar.gz artifacts.tar.gz lfs.tar.gz registry.tar.gz}
       )
       expect(exit_status).to eq(0)
       expect(tar_contents).to match('db/')
@@ -131,12 +132,13 @@ describe 'gitlab:app namespace rake task' do
       expect(tar_contents).to match('builds.tar.gz')
       expect(tar_contents).to match('artifacts.tar.gz')
       expect(tar_contents).to match('lfs.tar.gz')
-      expect(tar_contents).not_to match(/^.{4,9}[rwx].* (database.sql.gz|uploads.tar.gz|repositories|builds.tar.gz|artifacts.tar.gz)\/$/)
+      expect(tar_contents).to match('registry.tar.gz')
+      expect(tar_contents).not_to match(/^.{4,9}[rwx].* (database.sql.gz|uploads.tar.gz|repositories|builds.tar.gz|artifacts.tar.gz|registry.tar.gz)\/$/)
     end
 
     it 'should delete temp directories' do
       temp_dirs = Dir.glob(
-        File.join(Gitlab.config.backup.path, '{db,repositories,uploads,builds,artifacts,lfs}')
+        File.join(Gitlab.config.backup.path, '{db,repositories,uploads,builds,artifacts,lfs,registry}')
       )
 
       expect(temp_dirs).to be_empty
@@ -172,7 +174,7 @@ describe 'gitlab:app namespace rake task' do
 
     it "does not contain skipped item" do
       tar_contents, _exit_status = Gitlab::Popen.popen(
-        %W{tar -tvf #{@backup_tar} db uploads.tar.gz repositories builds.tar.gz artifacts.tar.gz lfs.tar.gz}
+        %W{tar -tvf #{@backup_tar} db uploads.tar.gz repositories builds.tar.gz artifacts.tar.gz lfs.tar.gz registry.tar.gz}
       )
 
       expect(tar_contents).to match('db/')
@@ -180,6 +182,7 @@ describe 'gitlab:app namespace rake task' do
       expect(tar_contents).to match('builds.tar.gz')
       expect(tar_contents).to match('artifacts.tar.gz')
       expect(tar_contents).to match('lfs.tar.gz')
+      expect(tar_contents).to match('registry.tar.gz')
       expect(tar_contents).not_to match('repositories/')
     end
 
@@ -195,6 +198,7 @@ describe 'gitlab:app namespace rake task' do
       expect(Rake::Task['gitlab:backup:builds:restore']).to receive :invoke
       expect(Rake::Task['gitlab:backup:artifacts:restore']).to receive :invoke
       expect(Rake::Task['gitlab:backup:lfs:restore']).to receive :invoke
+      expect(Rake::Task['gitlab:backup:registry:restore']).to receive :invoke
       expect(Rake::Task['gitlab:shell:setup']).to receive :invoke
       expect { run_rake_task('gitlab:backup:restore') }.not_to raise_error
     end