docker4完善仓库

[root@server1 ~]# docker volume prune 

把存在的但是不用的卷全部删掉

[root@server1 ~]# docker container prune

删掉所有停止的容器

[root@server1 ~]# docker image prune 

删掉不用的镜像
镜像加速器使用的是阿里云的私有加速器
1.加密仓库

[root@server1 ~]# mkdir -p certs

[root@server1 ~]# openssl req -newkey rsa:4096 -nodes -sha256 -keyout certs/westos.org.key -x509 -days 365 -out certs/westos.org.crt
Generating a 4096 bit RSA private key
...............................................................................................................++
........................................................++
writing new private key to 'certs/westos.org.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:cn
string is too long, it needs to be less than  2 bytes long
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:Shaanxi
Locality Name (eg, city) [Default City]:Xi'an
Organization Name (eg, company) [Default Company Ltd]:westos
Organizational Unit Name (eg, section) []:linux
Common Name (eg, your name or your server's hostname) []:reg.westos.org
Email Address []:root@westos.org
[root@server1 ~]# ls certs/
westos.org.crt  westos.org.key

以上为生成自签名证书交给仓库

[root@server1 ~]# docker run -d \
>   --restart=always \
>   --name registry \
>   -v "$(pwd)"/certs:/certs \
>   -e REGISTRY_HTTP_ADDR=0.0.0.0:443 \
>   -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/westos.org.crt \
>   -e REGISTRY_HTTP_TLS_KEY=/certs/westos.org.key \
>   -p 443:443 -v /opt/registry:/var/lib/registry registry
0945da9e9740c3e528b85e3549f0678761f7b334f8f67a63fba67dac30f4c232
[root@server1 ~]# docker ps
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS                                             NAMES
0945da9e9740        registry            "/entrypoint.sh /etc…"   7 seconds ago       Up 6 seconds        0.0.0.0:443->443/tcp, :::443->443/tcp, 5000/tcp   registry

加密完成，以上所做的是将证书和key都放在仓库里

[root@server1 ~]# docker ps
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS                                             NAMES
0945da9e9740        registry            "/entrypoint.sh /etc…"   7 seconds ago       Up 6 seconds        0.0.0.0:443->443/tcp, :::443->443/tcp, 5000/tcp   registry
[root@server1 ~]# cd /opt/registry/
[root@server1 registry]# ls

会自动生成此目录

[root@server1 registry]# vim /etc/hosts

不管从哪里链接都要做解析

[root@server1 ~]# docker tag yakexi007/nginx:latest reg.westos.org/nginx:latest
[root@server1 ~]# docker ps
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS                                             NAMES
0945da9e9740        registry            "/entrypoint.sh /etc…"   19 minutes ago      Up 19 minutes       0.0.0.0:443->443/tcp, :::443->443/tcp, 5000/tcp   registry
[root@server1 ~]# docker push reg.westos.org/nginx
The push refers to repository [reg.westos.org/nginx]
Get https://reg.westos.org/v2/: x509: certificate signed by unknown authority

改名，现在是从reg.westos.org路径
push以后发现，解析没问题，但是是没有证书,所以失败了。
如何让docker获取这个证书？

[root@server1 docker]# cd /etc/docker/
[root@server1 docker]# mkdir certs.d
[root@server1 docker]# cd certs.d/
[root@server1 certs.d]# mkdir reg.westos.org
[root@server1 certs.d]# cd reg.westos.org/
[root@server1 reg.westos.org]# cp ~/certs/westos.org.crt ca.crt
[root@server1 reg.westos.org]# ls
ca.crt
[root@server1 reg.westos.org]# pwd
/etc/docker/certs.d/reg.westos.org

以上为步骤，解决办法：先在docker的配置目录下创建证书目录，进入该目录之后，再创建对应仓库名字的证书目录，最后，复制家目录下的自签名证书到仓库证书目录中。
再次push

[root@server1 reg.westos.org]# docker push reg.westos.org/nginx
The push refers to repository [reg.westos.org/nginx]
3bd8699f28ba: Pushed 
1d3b68b6972f: Pushed 
de1602ca36c9: Pushed 
latest: digest: sha256:5ea5a786e978abd8e6e0b6c0f37f7271be19c40d6b8247b1d9dae70c1fbab9eb size: 949

2.接着在加密成功的基础上做认证
需要有用户名和密码

[root@server1 ~]# yum install httpd-tools -y

[root@server1 ~]# htpasswd -c auth/htpasswd admin
New password: 
Re-type new password: 
Adding password for user admin

创建一个用户名和密码

[root@server1 ~]# htpasswd -cB auth/htpasswd admin
New password: 
Re-type new password: 
Adding password for user admin

加B可以强制加密，非常安全
下一步加上基础认证
删除原先的registry，保证这个名字的唯一性。

[root@server1 ~]# docker rm -f registry 
registry

[root@server1 ~]# ll -d /opt/registry/
drwxr-xr-x 3 root root 20 Jun 17 14:28 /opt/registry/

数据保存在此所以不需要担心

[root@server1 ~]# mkdir data
[root@server1 ~]# mv auth/ certs/ data/
[root@server1 ~]# ls data/
auth  certs

[root@server1 ~]# docker run -d   --restart=always   --name registry   -v /data/certs:/certs   -e REGISTRY_HTTP_ADDR=0.0.0.0:443   -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/westos.org.crt   -e REGISTRY_HTTP_TLS_KEY=/certs/westos.org.key   -p 443:443 -v /opt/registry:/var/lib/registry -v /data/auth:/auth -e "REGISTRY_AUTH=htpasswd" -e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd  registry
73d2ad75048193e2df0e3a02505c9145e785bc3aade29fd34e22974bf73965db

再次将证书和key放在仓库里

[root@server1 ~]# docker push reg.westos.org/nginx
The push refers to repository [reg.westos.org/nginx]
Get https://reg.westos.org/v2/: dial tcp 172.25.250.11:443: connect: connection refused

[root@server1 ~]# docker login reg.westos.org
Username: admin
Password: 
Error response from daemon: Get https://reg.westos.org/v2/: dial tcp 172.25.250.11:443: connect: connection refused

遇到了问题，目前无法解决，按照百度的方法并且检查解析IP和重启都没有用，记录一下，先看其他的。