搭建企业级私有仓库harbor

harbor简介

harbor是由wmware公司开源的企业级docker registry项目

它提供了以下主要功能和特点:

  1. 基于角色访问控制RBAC):可以为不同的用户用户组分配不同的权限,增强了安全性和管理的灵活性
  2. 惊醒复制:支持在不同的harbor实例之间复制镜像,方便在多个数据中心或环境中分发镜像
  3. 图形化用户界面UI):提供了直观的web界面,便于管理镜像仓库、项目、用户等。
  4. 审计日志:记录了对镜像仓库各种操作,有助于追踪和审查活动
  5. 垃圾回收:可以清理不再使用的镜像节约存储空间

实验环境准备

下载软件包

在这里插入图片描述

这里我们选择v2.5.4版本
在这里插入图片描述
选择.tgz的包,进行下载

安装docker-ce

[root@docker-harbor ~]# yum install docker-ce -y


[root@docker-harbor ~]# systemctl enable --now docker

hosts解析

[root@docker-harbor ~]# cat /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
172.25.254.139  reg.huazi.com

实验步骤

配置https加密传输

  • 证书key
[root@docker-harbor ~]# openssl req -newkey rsa:4096 -nodes -sha256 -keyout certs/huazi.com.key -addext "subjectAltName = DNS:reg.huazi.com" -x509 -days 365 -out certs/huazi.com.crt
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:shanxi
Locality Name (eg, city) [Default City]:xi'an
Organization Name (eg, company) [Default Company Ltd]:docker
Organizational Unit Name (eg, section) []:registry
Common Name (eg, your name or your server's hostname) []:reg.huazi.com
Email Address []:admin@huazi.com



[root@docker-harbor ~]# cd certs/
[root@docker-harbor certs]# ls
huazi.com.crt  huazi.com.key
[root@docker-harbor certs]#
  • 证书位置/root/certs/huazi.com.crt
  • key位置/root/certs/huazi.com.key

客户端获取harbor端的证书

[root@docker-harbor ~]# mkdir -p /etc/docker/certs.d/reg.huazi.com/
[root@docker-harbor ~]# cp /root/certs/huazi.com.crt /etc/docker/certs.d/reg.huazi.com/ca.crt

[root@docker-harbor ~]# systemctl restart docker

解压

[root@docker-harbor ~]# tar -zxvf harbor-offline-installer-v2.5.4.tgz
harbor/harbor.v2.5.4.tar.gz
harbor/prepare
harbor/LICENSE
harbor/install.sh
harbor/common.sh
harbor/harbor.yml.tmpl

进入解压目录,修改文件配置

[root@docker-harbor ~]# cd harbor/
[root@docker-harbor harbor]# ls
common.sh  harbor.v2.5.4.tar.gz  harbor.yml.tmpl  install.sh  LICENSE  prepare


[root@docker-harbor harbor]# cp harbor.yml.tmpl harbor.yml


[root@docker-harbor harbor]# ls
common.sh  harbor.v2.5.4.tar.gz  harbor.yml  harbor.yml.tmpl  install.sh  LICENSE  prepare

#其中harbor.v2.5.4.tar.gz是一个镜像包
[root@docker-harbor harbor]# vim harbor.yml

在这里插入图片描述

在这里插入图片描述

hostname: reg.huazi.com

# http related config
http:
  # port for http, default is 80. If https enabled, this port will redirect to https port
  port: 80

# https related config
https:
  # https port for harbor, default is 443
  port: 443
  # The path of cert and key files for nginx
  certificate: /root/certs/huazi.com.crt
  private_key: /root/certs/huazi.com.key
  # enable strong ssl ciphers (default: false)
  # strong_ssl_ciphers: false


harbor_admin_password: 123456

启动harbor

[root@docker-harbor harbor]# ./install.sh --help

Note: Please set hostname and other necessary attributes in harbor.yml first. DO NOT use localhost or 127.0.0.1 for hostname, because Harbor needs to be accessed by external clients.
Please set --with-notary if needs enable Notary in Harbor, and set ui_url_protocol/ssl_cert/ssl_cert_key in harbor.yml bacause notary must run under https.
Please set --with-trivy if needs enable Trivy in Harbor
Please set --with-chartmuseum if needs enable Chartmuseum in Harbor
  1. 设置主机名和其他必要属性

    • 确实,您需要在harbor.yml文件中设置主机名(hostname)和其他必要的配置属性。
    • 主机名不应设置为localhost127.0.0.1,因为Harbor需要能够被外部客户端访问。
  2. 关于Notary

    • 注意:根据Harbor最新文档Notary可能已经被弃用或不再是Harbor核心组件。在配置Harbor时,如果您看到关于Notary的文档或选项,请确保它们与您正在使用的Harbor版本保持一致。如果Notary已被弃用,则不应再尝试启用它。
    • 如果您的Harbor版本仍然支持Notary,并且您需要在Harbor中启用它,那么您可能需要在安装或配置Harbor时添加--with-notary选项(尽管这取决于您的Harbor版本)。但是,由于Notary需要HTTPS,您还必须在harbor.yml中设置ui_url_protocolhttps,并提供有效的SSL证书(ssl_certssl_cert_key)。
  3. 关于Trivy

    • 如果您需要在Harbor中启用Trivy(一个用于容器镜像漏洞扫描器),请在安装或配置Harbor时添加--with-trivy选项。
  4. 关于Chartmuseum

    • 注意:同样地,根据Harbor最新文档Chartmuseum可能已经被整合为Harbor的一个内置组件,或者作为可选插件提供,或者已经完全被另一个组件取代。请查阅您正在使用的Harbor版本的官方文档以获取准确信息。
    • 如果您的Harbor版本仍然支持Chartmuseum作为独立组件,并且您需要在Harbor中启用它,那么您可能需要在安装或配置Harbor时添加--with-chartmuseum选项。但是,请注意,如果Chartmuseum已被整合或取代,则此选项可能不再有效。

这里我们需要Chartmuseum组件

[root@docker-harbor harbor]# ./install.sh --with-chartmuseum

[Step 0]: checking if docker is installed ...

Note: docker version: 27.3.1

[Step 1]: checking docker-compose is installed ...

Note: Docker Compose version v2.29.7

[Step 2]: loading Harbor images ...
......
......
......
[+] Running 12/12
 ✔ Network harbor_harbor-chartmuseum  Created                                            0.1s
 ✔ Network harbor_harbor              Created                                            0.1s
 ✔ Container harbor-log               Started                                            0.4s
 ✔ Container harbor-portal            Started                                            1.4s
 ✔ Container chartmuseum              Started                                            1.1s
 ✔ Container redis                    Started                                            1.5s
 ✔ Container registry                 Started                                            1.4s
 ✔ Container registryctl              Started                                            1.2s
 ✔ Container harbor-db                Started                                            1.4s
 ✔ Container harbor-core              Started                                            1.8s
 ✔ Container harbor-jobservice        Started                                            2.3s
 ✔ Container nginx                    Started                                            2.3s
✔ ----Harbor has been installed and started successfully.----


[root@docker-harbor harbor]# ls
common     docker-compose.yml    harbor.yml       install.sh  prepare
common.sh  harbor.v2.5.4.tar.gz  harbor.yml.tmpl  LICENSE
  • 当执行完后,我们发现出现了docker-compose.yml文件,这时就可以使用docker compose工具管理harbor后台
[root@docker-harbor harbor]# docker images
REPOSITORY                      TAG       IMAGE ID       CREATED       SIZE
goharbor/harbor-exporter        v2.5.4    388b5ac2eed4   2 years ago   87.4MB
goharbor/chartmuseum-photon     v2.5.4    e5134e6ca037   2 years ago   231MB
goharbor/redis-photon           v2.5.4    c89d59625d5a   2 years ago   155MB
goharbor/trivy-adapter-photon   v2.5.4    1142826e8329   2 years ago   251MB
goharbor/notary-server-photon   v2.5.4    e542ccac08c2   2 years ago   112MB
goharbor/notary-signer-photon   v2.5.4    65644cf6aaa1   2 years ago   109MB
goharbor/harbor-registryctl     v2.5.4    984f0c8cd458   2 years ago   136MB
goharbor/registry-photon        v2.5.4    5e2d95b5227f   2 years ago   78.1MB
goharbor/nginx-photon           v2.5.4    0e682f78c76f   2 years ago   154MB
goharbor/harbor-log             v2.5.4    1c30eb78ebc4   2 years ago   161MB
goharbor/harbor-jobservice      v2.5.4    01ec4f1c5ddd   2 years ago   233MB
goharbor/harbor-core            v2.5.4    fb4df7c64e84   2 years ago   208MB
goharbor/harbor-portal          v2.5.4    bba3d21bc4b9   2 years ago   162MB
goharbor/harbor-db              v2.5.4    76e7b3295f2b   2 years ago   225MB
goharbor/prepare                v2.5.4    5582f3ef9fbe   2 years ago   163MB
[root@docker-harbor harbor]# docker ps
CONTAINER ID   IMAGE                                COMMAND                   CREATED              STATUS                        PORTS                                                                                NAMES
9750c866f450   goharbor/nginx-photon:v2.5.4         "nginx -g 'daemon of…"   About a minute ago   Up About a minute (healthy)   0.0.0.0:80->8080/tcp, [::]:80->8080/tcp, 0.0.0.0:443->8443/tcp, [::]:443->8443/tcp   nginx
7d2a693579de   goharbor/harbor-jobservice:v2.5.4    "/harbor/entrypoint.…"   About a minute ago   Up About a minute (healthy)                                                                                        harbor-jobservice
569947c42e90   goharbor/harbor-core:v2.5.4          "/harbor/entrypoint.…"   About a minute ago   Up About a minute (healthy)                                                                                        harbor-core
8ef39f2a9087   goharbor/harbor-registryctl:v2.5.4   "/home/harbor/start.…"   About a minute ago   Up About a minute (healthy)                                                                                        registryctl
ce6c6ddef843   goharbor/chartmuseum-photon:v2.5.4   "./docker-entrypoint…"   About a minute ago   Up About a minute (healthy)                                                                                        chartmuseum
f2aaf4d9bdda   goharbor/registry-photon:v2.5.4      "/home/harbor/entryp…"   About a minute ago   Up About a minute (healthy)                                                                                        registry
2f9cb0b7d2d6   goharbor/redis-photon:v2.5.4         "redis-server /etc/r…"   About a minute ago   Up About a minute (healthy)                                                                                        redis
1de7bf425061   goharbor/harbor-db:v2.5.4            "/docker-entrypoint.…"   About a minute ago   Up About a minute (healthy)                                                                                        harbor-db
ee52470792cd   goharbor/harbor-portal:v2.5.4        "nginx -g 'daemon of…"   About a minute ago   Up About a minute (healthy)                                                                                        harbor-portal
497e949edfa7   goharbor/harbor-log:v2.5.4           "/bin/sh -c /usr/loc…"   About a minute ago   Up About a minute (healthy)   127.0.0.1:1514->10514/tcp                                                            harbor-log

此时容器会被自动开启

测试

在这里插入图片描述
在这里插入图片描述

  • 新建一个项目

在这里插入图片描述
在这里插入图片描述

  • huazi项目中目前没有镜像

在这里插入图片描述

客户端配置harbor本地加速器

[root@docker-harbor docker]# cd /etc/docker/
[root@docker-harbor docker]# vim daemon.json
{
  "registry-mirrors": ["https://reg.huazi.com"]
}


[root@docker-harbor docker]# systemctl restart docker
  • 客户端登录到harbor仓库
[root@docker-harbor harbor]# docker login reg.huazi.com
Username: admin
Password:
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credential-stores

Login Succeeded
  • 上传镜像(上传到reg.huazi.com网址中的huazi目录下)
[root@docker-harbor ~]# docker images
timinglee/mario                 latest    9a35a9e43e8c   9 years ago   198MB

[root@docker-harbor docker]# docker   tag   timinglee/mario:latest    reg.huazi.com/huazi/mario

[root@docker-harbor ~]# docker images
timinglee/mario                 latest    9a35a9e43e8c   9 years ago   198MB
reg.huazi.com/huazi/mario       latest    9a35a9e43e8c   9 years ago   198MB


#上传成功
[root@docker-harbor docker]# docker push reg.huazi.com/huazi/mario
Using default tag: latest
The push refers to repository [reg.huazi.com/huazi/mario]
5f70bf18a086: Pushed
44e5704d49fb: Pushed
dbe97b1b7330: Pushed
90222f49bc4c: Pushed
708fd576a927: Pushed
4aeeaca5ce76: Pushed
latest: digest: sha256:f4a933fb5a431e84e3d2623bfaa776c0d973d572b6db0a0b16dc243ffc7bcfa1 size: 2392
  • huazi目录下发现上传的镜像
    在这里插入图片描述
  • 上传镜像(上传到reg.huazi.com网址中的library目录下)
[root@docker-harbor docker]# docker  tag   timinglee/mario:latest   reg.huazi.com/library/chaojimali

[root@docker-harbor docker]# docker images
reg.huazi.com/library/chaojimali   latest    9a35a9e43e8c   9 years ago   198MB

#发现上传成功
[root@docker-harbor docker]# docker push reg.huazi.com/library/chaojimali
Using default tag: latest
The push refers to repository [reg.huazi.com/library/chaojimali]
5f70bf18a086: Pushed
44e5704d49fb: Pushed
dbe97b1b7330: Pushed
90222f49bc4c: Pushed
708fd576a927: Pushed
4aeeaca5ce76: Pushed
latest: digest: sha256:f4a933fb5a431e84e3d2623bfaa776c0d973d572b6db0a0b16dc243ffc7bcfa1 size: 2392
  • library目录下发现上传的镜像
    在这里插入图片描述

注意

  • docker tag时,harbor仓库网址名称项目名称一定要正确,否则上传会失败
  • harbor仓库搭建成功后,默认会有一个管理员账户admin

删掉这个chaojimali镜像后,重新拉取

[root@docker-harbor docker]# docker rmi reg.huazi.com/library/chaojimali:latest
Untagged: reg.huazi.com/library/chaojimali:latest
Untagged: reg.huazi.com/library/chaojimali@sha256:f4a933fb5a431e84e3d2623bfaa776c0d973d572b6db0a0b16dc243ffc7bcfa1
[root@docker-harbor docker]# docker pull chaojimali
Using default tag: latest
latest: Pulling from library/chaojimali
Digest: sha256:f4a933fb5a431e84e3d2623bfaa776c0d973d572b6db0a0b16dc243ffc7bcfa1
Status: Downloaded newer image for chaojimali:latest
docker.io/library/chaojimali:latest
[root@docker-harbor docker]# docker images
chaojimali                      latest    9a35a9e43e8c   9 years ago   198MB

通过docker compose管理harbor

  • docker compose down停止并删除容器
[root@docker-harbor harbor]# docker compose down
WARN[0000] /root/harbor/docker-compose.yml: the attribute `version` is obsolete, it will be ignored, please remove it to avoid potential confusion
[+] Running 12/12
 ✔ Container harbor-jobservice        Removed                                            0.1s
 ✔ Container chartmuseum              Removed                                            0.1s
 ✔ Container nginx                    Removed                                            0.2s
 ✔ Container registryctl              Removed                                           10.1s
 ✔ Container harbor-portal            Removed                                            0.1s
 ✔ Container harbor-core              Removed                                            0.1s
 ✔ Container harbor-db                Removed                                            0.1s
 ✔ Container registry                 Removed                                            0.1s
 ✔ Container redis                    Removed                                            0.2s
 ✔ Container harbor-log               Removed                                           10.1s
 ✔ Network harbor_harbor              Removed                                            0.1s
 ✔ Network harbor_harbor-chartmuseum  Removed                                            0.1s
  • docker compose up -d启动容器
  • -d后台运行
[root@docker-harbor harbor]# docker ps -a
CONTAINER ID   IMAGE     COMMAND   CREATED   STATUS    PORTS     NAMES

[root@docker-harbor harbor]# docker compose up -d
WARN[0000] /root/harbor/docker-compose.yml: the attribute `version` is obsolete, it will be ignored, please remove it to avoid potential confusion
[+] Running 12/12
 ✔ Network harbor_harbor-chartmuseum  Created                                            0.1s
 ✔ Network harbor_harbor              Created                                            0.1s
 ✔ Container harbor-log               Started                                            0.3s
 ✔ Container harbor-db                Started                                            1.0s
 ✔ Container chartmuseum              Started                                            0.9s
 ✔ Container registry                 Started                                            1.1s
 ✔ Container registryctl              Started                                            1.0s
 ✔ Container harbor-portal            Started                                            0.9s
 ✔ Container redis                    Started                                            1.1s
 ✔ Container harbor-core              Started                                            1.4s
 ✔ Container harbor-jobservice        Started                                            1.7s
 ✔ Container nginx                    Started                                            1.8s
[root@docker-harbor harbor]#
[root@docker-harbor harbor]# docker ps
CONTAINER ID   IMAGE                                COMMAND                   CREATED          STATUS                             PORTS                                                                                NAMES
61e8a6e26ad5   goharbor/nginx-photon:v2.5.4         "nginx -g 'daemon of…"   19 seconds ago   Up 17 seconds (health: starting)   0.0.0.0:80->8080/tcp, [::]:80->8080/tcp, 0.0.0.0:443->8443/tcp, [::]:443->8443/tcp   nginx
fa10c0be1ad3   goharbor/harbor-jobservice:v2.5.4    "/harbor/entrypoint.…"   19 seconds ago   Up 17 seconds (health: starting)                                                                                        harbor-jobservice
cbd69a01ce0d   goharbor/harbor-core:v2.5.4          "/harbor/entrypoint.…"   19 seconds ago   Up 18 seconds (health: starting)                                                                                        harbor-core
4352cec1c54b   goharbor/harbor-registryctl:v2.5.4   "/home/harbor/start.…"   19 seconds ago   Up 18 seconds (health: starting)                                                                                        registryctl
b4568f0c1d07   goharbor/chartmuseum-photon:v2.5.4   "./docker-entrypoint…"   19 seconds ago   Up 18 seconds (health: starting)                                                                                        chartmuseum
eed6568a9ea5   goharbor/redis-photon:v2.5.4         "redis-server /etc/r…"   19 seconds ago   Up 18 seconds (health: starting)                                                                                        redis
ff667909ae29   goharbor/registry-photon:v2.5.4      "/home/harbor/entryp…"   19 seconds ago   Up 18 seconds (health: starting)                                                                                        registry
132db9f5db03   goharbor/harbor-db:v2.5.4            "/docker-entrypoint.…"   19 seconds ago   Up 18 seconds (health: starting)                                                                                        harbor-db
287bc1e29cdf   goharbor/harbor-portal:v2.5.4        "nginx -g 'daemon of…"   19 seconds ago   Up 18 seconds (health: starting)                                                                                        harbor-portal
255ae63496e6   goharbor/harbor-log:v2.5.4           "/bin/sh -c /usr/loc…"   19 seconds ago   Up 19 seconds (health: starting)   127.0.0.1:1514->10514/tcp                                                            harbor-log
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包

打赏作者

^~^前行者~~~

你的鼓励将是我创作的最大动力

¥1 ¥2 ¥4 ¥6 ¥10 ¥20
扫码支付:¥1
获取中
扫码支付

您的余额不足,请更换扫码支付或充值

打赏作者

实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值