docker（3）- 仓库搭建及harbor使用

目录

docker仓库

配置镜像加速器

registry私有仓库

insecure registry

仓库加密

仓库认证

harbor企业级私有仓库

部署docker-compose

---

docker仓库

官方仓库：Docker

配置镜像加速器

[root@k8s1 ~]# vim /etc/docker/daemon.json

{

"registry-mirrors": ["https://registry.docker-cn.com"]

}

重启docker生效

[root@k8s1 ~]# systemctl restart docker

[root@k8s1 ~]# docker info

registry私有仓库

拉取registry镜像

[root@k8s1 ~]# docker pull registry

运行registry仓库

[root@k8s1 docker]# docker run -d -p 5000:5000 --restart=always --name registry registry

上传镜像

[root@k8s1 ~]# docker tag nginx:latest localhost:5000/nginx:latest

[root@k8s1 ~]# docker push localhost:5000/nginx

[root@k8s1 ~]# curl localhost:5000/v2/_catalog

{"repositories":["nginx"]}

下载镜像

[root@k8s1 ~]# docker pull localhost:5000/nginx

insecure registry

添加私有仓库解析

[root@k8s2 ~]# cat /etc/hosts

127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4

::1 localhost localhost.localdomain localhost6 localhost6.localdomain6

192.168.56.171 k8s1 reg.westos.org

192.168.56.172 k8s2

配置使用非加密端口

[root@k8s2 ~]# vim /etc/docker/daemon.json

{

"insecure-registries" : ["reg.westos.org:5000"]

}

[root@k8s2 docker]# systemctl restart docker

拉取镜像

[root@k8s2 docker]# docker pull reg.westos.org:5000/nginx

仓库加密

升级软件包

[root@k8s1 ~]# yum install -y openssl11-1.1.1k-2.el7.x86_64.rpm openssl11-libs-1.1.1k-2.el7.x86_64.rpm

生成证书和密钥

[root@k8s1 ~]# mkdir certs

[root@k8s1 ~]# openssl11 req -newkey rsa:4096 -nodes -sha256 -keyout certs/westos.org.key -addext "subjectAltName = DNS:reg.westos.org" -x509 -days 365 -out certs/westos.org.crt

域名保持一致

 后台运行，拉起容器

[root@k8s1 ~]# docker run -d -p 443:443 --restart=always --name registry -v /opt/registry:/var/lib/registry -v /root/certs:/certs -e REGISTRY_HTTP_ADDR=0.0.0.0:443 -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/westos.org.crt -e REGISTRY_HTTP_TLS_KEY=/certs/westos.org.key registry

部署客户端证书，不然会报错

标记重命名nginx并归类到本地reg.westos.org仓库中

[root@k8s1 ~]# docker tag nginx:latest reg.westos.org/nginx:latest

上传reg.westos.org/nginx:latest镜像

[root@k8s1 ~]# docker push reg.westos.org/nginx:latest The push refers to repository [reg.westos.org/nginx]

Get "https://reg.westos.org/v2/": x509: certificate signed by unknown authority

创建docker下的证书目录下的reg.westos.org子目录

[root@k8s1 ~]# mkdir -p /etc/docker/certs.d/reg.westos.org/

复制证书到docker下证书目录

[root@k8s1 ~]# cp /root/certs/westos.org.crt /etc/docker/certs.d/reg.westos.org/ca.crt

验证：测试查看上传的内容，测试成功

[root@k8s1 ~]# docker push reg.westos.org/nginx:latest

[root@k8s1 reg.westos.org]# curl -k https://reg.westos.org/v2/_catalog

{"repositories":["nginx"]}

仓库认证

下载压测工具

[root@k8s1 ~]# yum install -y httpd-tools

家目录下创建认证目录

[root@k8s1 ~]# mkdir auth

创建admin用户认证信息和密码（注意第一次加参数c，之后不加，否则会覆盖原来的）

[root@k8s1 ~]# htpasswd -Bc auth/htpasswd admin

New password:

Re-type new password:

Adding password for user admin

创建wxh用户认证信息和密码

[root@k8s1 ~]# htpasswd -B auth/htpasswd wxh

New password:

Re-type new password:

Adding password for user wxh

查看已经生成的认证

[root@k8s1 ~]# cat auth/htpasswd

admin:$2y$05$Wm2LHttPY5a6i2KMG0fShe92d/PjnaBbGitiClcE3wqHmwO8dIDFm

wxh:$2y$05$9rE9CXyZ1fdcMammhh7f6.soDHgKdSsi0DXBgkRW5sKRw5sEJo1lK

删除registry，重建

[root@k8s1 ~]# docker rm -f registry

[root@k8s1 ~]# docker run -d -p 443:443 --restart=always --name registry -v /opt/registry:/var/lib/registry -v /root/certs:/certs -e REGISTRY_HTTP_ADDR=0.0.0.0:443 -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/westos.org.crt -e REGISTRY_HTTP_TLS_KEY=/certs/westos.org.key -v /root/auth:/auth -e "REGISTRY_AUTH=htpasswd" -e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd registry

登录仓库，不然无法上传下载

[root@k8s1 ~]# docker login reg.westos.org

Username: admin

Password:

WARNING! Your password will be stored unencrypted in /root/.docker/config.json.

Configure a credential helper to remove this warning. See

https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded

[root@k8s1 ~]# cat .docker/config.json

{

"auths": {

"reg.westos.org": {

"auth": "YWRtaW46d2VzdG9z"

}

}

}

验证

[root@k8s1 ~]# docker tag busybox:latest reg.westos.org/busybox:latest

[root@k8s1 ~]# docker push reg.westos.org/busybox:latest

[root@k8s1 ~]# curl -k https://reg.westos.org/v2/_catalog -u admin:westos

{"repositories":["busybox","nginx"]}

登出

[root@k8s1 ~]# docker logout reg.westos.org

harbor企业级私有仓库

Harbor是由VMware公司开源的企业级的Docker Registry管理项目，相比docker官方拥有更丰富的权限权利和完善的架构设计，适用大规模docker集群部署提供仓库服务。

删除之前部署的registry，不然会冲突

[root@k8s1 ~]# docker rm -f registry

解压离线包并进入目录

[root@k8s1 ~]# tar zxf harbor-offline-installer-v2.5.0.tgz

[root@k8s1 ~]# cd harbor/

备份并修改配置文件，注意证书和密钥路径要对

[root@k8s1 harbor]# cp harbor.yml.tmpl harbor.yml

[root@k8s1 harbor]# vim harbor.yml

hostname: reg.westos.org

http:

# port for http, default is 80. If https enabled, this port will redirect to https port

port: 80

https:

# https port for harbor, default is 443

port: 443

# The path of cert and key files for nginx

certificate: /data/certs/westos.org.crt

private_key: /data/certs/westos.org.key

harbor_admin_password: westos

拷贝证书

[root@k8s1 ~ ]# mkdir /data

[root@k8s1 ~ ]# cp -r certs /data

部署docker-compose

用来管理多个容器的，定义启动顺序的，合理编排，方便管理。

[root@k8s1 ~]# mv docker-compose-linux-x86_64-v2.5.0 /usr/local/bin/docker-compose

[root@k8s1 ~]# chmod +x /usr/local/bin/docker-compose

部署harbor，执行安装脚本（时间较长耐心等待）

[root@k8s1 harbor]# ./install.sh --with-chartmuseum

 使用浏览器登录仓库 用户名：admin 密码是上面配置文件设置的westos

上传镜像，首先需要执行docker login

[root@k8s1 ~]# docker push reg.westos.org/library/nginx:latest

[root@k8s1 ~]# docker push reg.westos.org/library/busybox:latest

客户端配置默认私有仓库

[root@k8s2 ~]# vim /etc/docker/daemon.json

{

"registry-mirrors": ["https://reg.westos.org"]

}

[root@k8s2 ~]# systemctl restart docker

匿名拉取镜像

[root@k8s2 ~]# docker pull nginx

创建私有仓库

 

 

私有仓库上传和下载镜像都需要用户认证

[root@k8s2 ~]# docker login reg.westos.org

从私有仓库下载时需要指定仓库地址

[root@k8s2 ~]# docker pull reg.westos.org/westos/game2048:latest