安装harbor之前,需要安装好Python,Docker,DockerCompose。Python需要2.7以上的版本,Docker需要1.10以上的版本;Docker Compose 需要1.6.0以上的版本。
一:安装Docker Compose
https://docs.docker.com/compose/install/中介绍的各种安装方法,只有使用pip的方式才能安装成功。
使用pip安装,因为docker-compose的依赖包可能会与原有python环境的系统包冲突,因此文档中建议使用virtualenv。
首先安装virtualenv:
pip install virtualenv
然后为安装docker-compose创建虚拟环境:
mkdir -p /opt/testvenv
cd /opt/testvenv
virtualenv venv
激活虚拟环境,安装docker-compose:
source venv/bin/activate
pip install docker-compose
安装好的docker-compose在目录/opt/testvenv/venv/bin下,创建软链接:
ln -s /opt/testvenv/venv/bin/docker-compose /usr/local/bin/docker-compose
这样便安装好了docker-compose。
二:安装harbor
1:使用源码安装,通过git下载源码:
mkdir -p /opt/harbor/git
cd /opt/harbor/git
git clone https://github.com/vmware/harbor
2:配置harbor
在安装harbor之前,需要修改/opt/harbor/git/harbor/Deploy/harbor.cfg中的配置参数,然后执行prepare脚本来生成harbor所有容器的配置文件,最后运行docker compose启动harbor。
在文件harbor.cfg中,需要配置的参数如下:
hostname:私有仓库的主机名。可以是IP地址,也可以是域名。这里配置成192.168.1.104;
ui_url_protocol:用户访问私仓时使用的协议,默认时http,这里配置成https;
harbor_admin_password:harbor的管理员账户密码,默认密码是Harbor12345,用户名是admin;
其他配置参数可以参考:
https://github.com/vmware/harbor/blob/master/docs/installation_guide.md
3:配置https访问
用户访问harbor默认的协议是http,但是registry目前默认支持https访问,如果使用http,需要在访问私仓的主机上,修改docker的配置文件,增加--insecure-registry选项。
要配置https访问,首先生成证书:
mkdir -p /opt/harbor/cert/
openssl req -x509 -days 3650 -nodes -newkey rsa:2048 -keyout \
/opt/harbor/cert/domain.key -out /opt/harbor/cert/domain.crt
...
Country Name (2 letter code) [XX]:
State or Province Name (full name) []:
Locality Name (eg, city) [Default City]:
Organization Name (eg, company) [Default Company Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:192.168.1.104
Email Address []:
然后将生成的证书复制到nginx容器的特定目录下:
cp /opt/harbor/cert/domain.crt /opt/harbor/git/harbor/Deploy/config/nginx/cert/
cp /opt/harbor/cert/domain.key /opt/harbor/git/harbor/Deploy/config/nginx/cert/
然后修改/opt/harbor/git/harbor/Deploy/config/nginx目录下的配置文件:
mv nginx.conf nginx.conf.bak
cp nginx.https.conf nginx.conf
修改nginx.conf文件内容:
server {
listen 443 ssl;
server_name 192.168.1.104;
# SSL
ssl_certificate /etc/nginx/cert/domain.crt;
ssl_certificate_key /etc/nginx/cert/domain.key;
...
}
server {
listen 80;
server_name 192.168.1.104;
...
}
4:生成修改harbor容器的配置文件:
cd /opt/harbor/git/harbor/Deploy
./prepare
运行prepare之后,需要修改/opt/harbor/git/harbor/Deploy/docker-compose.yml文件中,容器的数据卷目录,首先创建数据卷目录:
mkdir -p /opt/harbor/data
mkdir -p /opt/harbor/data/registry
mkdir -p /opt/harbor/data/log
mkdir -p /opt/harbor/data/database
然后修改docker-compose.yml文件内容:
version: '2'
services:
log:
build: ./log/
volumes:
- /opt/harbor/data/log/:/var/log/docker/
ports:
- 1514:514
registry:
image: library/registry:2.4.0
volumes:
- /opt/harbor/data/registry:/storage
- ./config/registry/:/etc/registry/
environment:
- GODEBUG=netdns=cgo
ports:
- 5001:5001
command:
["serve", "/etc/registry/config.yml"]
depends_on:
- log
logging:
driver: "syslog"
options:
syslog-address: "tcp://127.0.0.1:1514"
syslog-tag: "registry"
mysql:
build: ./db/
volumes:
- /opt/harbor/data/database:/var/lib/mysql
env_file:
- ./config/db/env
depends_on:
- log
logging:
driver: "syslog"
options:
syslog-address: "tcp://127.0.0.1:1514"
syslog-tag: "mysql"
ui:
build:
context: ../
dockerfile: Dockerfile.ui
env_file:
- ./config/ui/env
volumes:
- ./config/ui/app.conf:/etc/ui/app.conf
- ./config/ui/private_key.pem:/etc/ui/private_key.pem
depends_on:
- log
logging:
driver: "syslog"
options:
syslog-address: "tcp://127.0.0.1:1514"
syslog-tag: "ui"
proxy:
image: library/nginx:1.9
volumes:
- ./config/nginx:/etc/nginx
ports:
- 80:80
- 443:443
depends_on:
- mysql
- registry
- ui
- log
logging:
driver: "syslog"
options:
syslog-address: "tcp://127.0.0.1:1514"
syslog-tag: "proxy"
因为当前主机访问外网时需要设置http代理,因此,在生成ui容器时也需要设置代理,因此需要修改/opt/harbor/git/harbor/Dockerfile.ui文件,在需要访问外网的apt-get和go get命令之前,设置代理地址:
FROM golang:1.6.2
MAINTAINER jiangd@vmware.com
RUN export https_proxy=http://192.168.1.22:1888 \
&& export http_proxy=http://192.168.1.22:8000 \
&& apt-get update \
&& apt-get install -y libldap2-dev \
&& rm -r /var/lib/apt/lists/*
COPY . /go/src/github.com/vmware/harbor
#golang.org is blocked in China
COPY ./vendor/golang.org /go/src/golang.org
WORKDIR /go/src/github.com/vmware/harbor/ui
RUN export https_proxy=http://192.168.1.22:1888 \
&& export http_proxy=http://192.168.1.22:8000 \
&& go get -d github.com/docker/distribution \
&& go get -d github.com/docker/libtrust \
&& go get -d github.com/go-sql-driver/mysql \
&& go build -v -a -o /go/bin/harbor_ui
ENV MYSQL_USR root \
MYSQL_PWD root \
REGISTRY_URL localhost:5000
COPY views /go/bin/views
COPY static /go/bin/static
COPY favicon.ico /go/bin/favicon.ico
RUN chmod u+x /go/bin/harbor_ui \
&& sed -i 's/TLS_CACERT/#TLS_CAERT/g' /etc/ldap/ldap.conf \
&& sed -i '$a\TLS_REQCERT allow' /etc/ldap/ldap.conf
WORKDIR /go/bin/
ENTRYPOINT ["/go/bin/harbor_ui"]
EXPOSE 80
5:启动harbor
cd /opt/harbor/git/harbor/Deploy
docker-compose up -d
此时,就会启动几个docker容器:
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
d4ee5bb2f8f6 library/nginx:1.9 "nginx -g 'daemon off" 3 hours ago Up 3 hours 0.0.0.0:80->80/tcp, 0.0.0.0:443->443/tcp deploy_proxy_1
1cf7fd095f7a deploy_mysql "docker-entrypoint.sh" 3 hours ago Up 3 hours 3306/tcp deploy_mysql_1
10ed70671b2e library/registry:2.4.0 "/bin/registry serve " 3 hours ago Up 3 hours 5000/tcp, 0.0.0.0:5001->5001/tcp deploy_registry_1
6ac4be116f4e deploy_ui "/go/bin/harbor_ui" 3 hours ago Up 3 hours 80/tcp deploy_ui_1
c42937c4362c deploy_log "/bin/sh -c 'cron && " 3 hours ago Up 3 hours 0.0.0.0:1514->514/tcp deploy_log_1
三:访问harbor私仓
需要访问私仓的客户端,需要复制刚生成的证书:将harbor主机上的/opt/harbor/cert/domain.crt文件,复制到客户端宿主机上的:
/etc/docker/certs.d/192.168.1.104/ca.crt
上传镜像:
docker tag hello-world 192.168.1.104/library/hello-world
docker push 192.168.1.104/library/hello-world
此时,在浏览器中访问192.168.1.104,就可以看见hello-world镜像:
下载镜像:
docker pull 192.168.1.104/library/hello-world
ps:
1:在私仓上删除镜像操作较麻烦,未研究;
2:mirror模式配置了很长时间都不成功;
参考:
https://github.com/vmware/harbor/blob/master/docs/installation_guide.md
https://github.com/vmware/harbor/blob/master/docs/configure_https.md
https://www.ustack.com/blog/docker/