Docker: What is the simplest way to secure a private registry?

I’m still learning how to run and use Docker, consider this an idea:

# Run the registry on the server, allow only localhost connection
docker run -p 127.0.0.1:5000:5000 registry

# On the client, setup ssh tunneling
ssh -N -L 5000:localhost:5000 user@server

The registry is then accessible at localhost:5000, authentication is done through ssh that you probably already know and use.

Sources:

• https://blog.codecentric.de/en/2014/02/docker-registry-run-private-docker-image-repository/
• https://docs.docker.com/userguide/dockerlinks/