Begin writing exercise 4.

data/workshop/exercise2.mdx

@@ -111,7 +111,7 @@ ssh -i disco_key ec2-user@$PREP_SYSTEM_IP
 
 ## 2.5 - Downloading required tools
 
-For the purposes of this workshop, rather than downloading mirror content to a USB drive as we would likely do in a real SneakerOps situation, we will instead be saving content to an EBS volume which will be mounted to our prep system on the **Low side** and then subsequently to our bastion system on the **High side**.
+For the purposes of this workshop, rather than downloading mirror content to a USB drive as we would likely do in a real SneakerOps situation, we will instead be saving content to an EBS volume which will be mounted to our prep system on the **Low side** and then subsequently synced to our bastion system on the **High side**.
 
 Once your prep system has booted let's mount the EBS volume we attached so we can start downloading content. Copy the commands below into your web terminal:
 

data/workshop/exercise3.mdx

@@ -83,8 +83,7 @@ ssh -i disco_key ec2-user@$PREP_SYSTEM_IP "echo HIGHSIDE_BASTION_IP=$(echo $HIGH
 Finally - Let's now connect all the way through to our **High side** bastion 🚀
 
 ```bash
-ssh -t -i disco_key ec2-user@$PREP_SYSTEM_IP "ssh -t -i disco_key ec2-user@$HIGHSIDE_B
-ASTION_IP"
+ssh -t -i disco_key ec2-user@$PREP_SYSTEM_IP "ssh -t -i disco_key ec2-user@$HIGHSIDE_BASTION_IP"
 ```
 
 <Zoom>
@@ -94,4 +93,25 @@ ASTION_IP"
 </Zoom>
 
 
+## 3.3 - Sneakernetting content to the high side
 
+We'll now deliver the **High side** gift basket to the bastion server. Start by mounting our EBS volume on the bastion server to ensure that we don't run out of space:
+
+```bash
+sudo mkfs -t xfs /dev/nvme1n1
+sudo mkdir /mnt/high-side
+sudo mount /dev/nvme1n1 /mnt/high-side
+sudo chown ec2-user:ec2-user /mnt/high-side
+```
+
+With the mount in place we can exit back to our base web terminal and send over our gift basket at `/mnt/high-side` using `rsync`.
+
+```bash
+ssh -t -i disco_key ec2-user@$PREP_SYSTEM_IP "rsync -avP -e 'ssh -i disco_key' /mnt/high-side ec2-user@$HIGHSIDE_BASTION_IP:/mnt"
+```
+
+<Zoom>
+|![workshop](/workshops/static/images/disconnected/sneakernet-transfer.gif)     | 
+|:-----------------------------------------------------------------------------:|
+| *Initiating the sneakernet transfer via rsync*                                |
+</Zoom>

data/workshop/exercise4.mdx

@@ -0,0 +1,83 @@
+---
+title: Deploying a mirror registry
+exercise: 4
+date: '2023-12-20'
+tags: ['openshift','containers','kubernetes','disconnected']
+draft: false
+authors: ['default']
+summary: "Let's start mirroring some content on our high side!"
+---
+
+Images used by operators and platform components must be mirrored from upstream sources into a container registry that is accessible by the **High side**. You can use any registry you like for this as long as it supports Docker `v2-2`, such as:
+- Red Hat Quay
+- JFrog Artifactory
+- Sonatype Nexus Repository
+- Harbor
+
+An OpenShift subscription includes access to the [mirror registry](https://docs.openshift.com/container-platform/4.14/installing/disconnected_install/installing-mirroring-creating-registry.html#installing-mirroring-creating-registry) for Red Hat OpenShift, which is a small-scale container registry designed specifically for mirroring images in disconnected installations. We'll make use of this option in this lab.
+
+Mirroring all release and operator images can take awhile depending on the network bandwidth. For this lab, recall that we're going to mirror just the release images to save time and resources.
+
+We should have the `mirror-registry` binary along with the required container images available on the bastion in `/mnt/high-side`. The `50GB` volume we created should be enough to hold our mirror (without operators) and binaries.
+
+
+## 4.1 - Opening mirror registry port ingress
+
+We are getting close to deploying a disconnected OpenShift cluster that will be spread across multiple machines which are in turn spread across our three private subnets.
+
+Each of the machines in those private subnets will need to talk back to our mirror registry on port `8443` so let's quickly update our aws security group to ensure this will work.
+
+> Note: We're going to allow traffic from all sources for simplicity (`0.0.0.0/0`), but this is likely to be more restrictive in real world environments:
+
+```bash
+SG_ID=$(aws ec2 describe-security-groups --filters "Name=tag:Name,Values=disco-sg" | jq -r '.SecurityGroups[0].GroupId')
+
+aws ec2 authorize-security-group-ingress --group-id $SG_ID --protocol tcp --port 8443 --cidr 0.0.0.0/0
+```
+
+
+## 4.2 - Running the registry install
+
+First, let's `ssh` back into the bastion:
+
+```bash
+ssh -t -i disco_key ec2-user@$PREP_SYSTEM_IP "ssh -t -i disco_key ec2-user@$HIGHSIDE_BASTION_IP"
+```
+
+And then we can kick off our install:
+
+```bash
+cd /mnt/high-side
+./mirror-registry install --quayHostname $(hostname) --quayRoot /mnt/high-side/quay/quay-install --quayStorage /mnt/high-side/quay/quay-storage --pgStorage /mnt/high-side/quay/pg-data --initPassword discopass
+```
+
+If all goes well, you should see something like:
+
+```text
+INFO[2023-07-06 15:43:41] Quay installed successfully, config data is stored in /mnt/quay/quay-install 
+INFO[2023-07-06 15:43:41] Quay is available at https://ip-10-0-51-47.ec2.internal:8443 with credentials (init, discopass) 
+```
+
+<Zoom>
+|![workshop](/workshops/static/images/disconnected/registry-install.gif)        | 
+|:-----------------------------------------------------------------------------:|
+| *Running the mirror-registry installer*                                       |
+</Zoom>
+
+
+## 4.3 Logging into the mirror registry
+
+Now that our registry is running let's login with `podman` which will generate an auth file at `/run/user/1000/containers/auth.json`.
+
+```bash
+podman login -u init -p discopass --tls-verify=false $(hostname):8443
+```
+> Note: We pass `--tls-verify=false` here for simplicity during this workshop, but you can optionally add `/mnt/high-side/quay/quay-install/quay-rootCA/rootCA.pem` to the system trust store by following the guide in the Quay documentation [here](https://access.redhat.com/documentation/en-us/red_hat_quay/3/html/manage_red_hat_quay/using-ssl-to-protect-quay?extIdCarryOver=true&sc_cid=701f2000001OH74AAG#configuring_the_system_to_trust_the_certificate_authority).
+
+
+## 4.4 Pushing content into mirror registry
+
+Now we're ready to mirror images from disk into the registry. Let's add oc and `oc-mirror` to the path:
+
+
+