Docker仓库认证registry

Docker 官方已经把仓库封装为镜像,直接通过启动容器就可以部署完成仓库

实验环境

物理机 172.25.41.250

一·仓库认证机制

1.证书

[root@foundation41 docker]# docker run -d --restart=always --name registry -v `pwd`/certs:/certs -e REGISTRY_HTTP_ADDR=0.0.0.0:443 -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt -e REGISTRY_HTTP_TLS_KEY=/certs/domain.key -p 443:443 registry:2
[root@foundation41 docker]# docker ps -a
[root@foundation41 ~]# iptables -t nat -nL

[root@foundation41 certs.d]# mkdir westos.org
[root@foundation41 certs.d]# cd westos.org/
[root@foundation41 westos.org]# ls
[root@foundation41 westos.org]# cp /tmp/docker/certs/domain.crt .
[root@foundation41 westos.org]# ls
domain.crt
[root@foundation41 westos.org]# mv domain.crt ca.crt
[root@foundation41 westos.org]# ls
ca.crt
[root@foundation41 westos.org]# cd
[root@foundation41 ~]# docker push westos.org/nginx

2.仓库

[root@foundation41 docker]# docker ps
[root@foundation41 docker]# docker rm -f registry
[root@foundation41 docker]# docker run -it --name vm1 -v /data1 ubuntu
root@55b40438a21b:/# mount
[root@foundation41 docker]# docker inspect vm1
[root@foundation41 docker]# docker inspect vm1 |grep vol
                "Type": "volume",
                "Source": "/var/lib/docker/volumes/17dd941ce05d840b5b0b94c973835a538cf72a674c10b25660f8e742052aa77a/_data",
[root@foundation41 docker]# cd /var/lib/docker/volumes/17dd941ce05d840b5b0b94c973835a538cf72a674c10b25660f8e742052aa77a/_data
[root@foundation41 _data]# ls
[root@foundation41 _data]# cp /etc/passwd .
[root@foundation41 _data]# ls
passwd

[root@foundation41 ~]# docker container attach vm1
root@55b40438a21b:/data1# ls
passwd
root@55b40438a21b