Docker容器（3）：搭建私有仓库

Docker基础知识

可以参考之前的文章Docker基础知识

Docker的基本使用方法

可以参考之前的文章Docker基本使用

部署私有仓库

先拉取仓库的镜像

联网的情况下直接执行下边的命令会自动从官方仓库拉取镜像：
[root@server1 ~]# docker run -d --name registry registry
未联网的情况：
[root@server1 ~]# docker load -i registry2.tar
d9ff549177a9: Loading layer  4.671MB/4.671MB
f641ef7a37ad: Loading layer  1.587MB/1.587MB
d5974ddb5a45: Loading layer  20.08MB/20.08MB
5bbc5831d696: Loading layer  3.584kB/3.584kB
73d61bf022fd: Loading layer  2.048kB/2.048kB
Loaded image: registry:2

运行仓库（不带认证）

[root@server1 ~]# docker run -d --name registry registry -v /opt/registry:/var/lib/registry -p 5000:5000 registry
#将容器的5000端口映射到宿主机的5000端口

查看端口状态，5000端口已开启，运行成功

运行仓库，curl访问看仓库里有什么

[root@server1 ~]# docker start registry
registry
[root@server1 ~]# curl localhost:5000/v2/_catalog
{"repositories":[]}
#我们还没上传镜像，所以仓库是空的

我们生成自签名证书，之后重新映射端口为443以认证的方式访问仓库
##因为443是https端口，ssl要求认证，所以我们要生成证书

[root@server1 ~]# openssl req -newkey rsa:4096 -nodes -sha256 -keyout certs/westos.org.key -x509 -days 365 -out certs/westos.org.crt
Generating a 4096 bit RSA private key
..............................++
...................................................++
writing new private key to 'certs/westos.org.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:cn
State or Province Name (full name) []:shanxi
Locality Name (eg, city) [Default City]:xi'an
Organization Name (eg, company) [Default Company Ltd]:westos
Organizational Unit Name (eg, section) []:linux
Common Name (eg, your name or your server's hostname) []:reg.westos.org		#注意这里主机名，我们就当作域名了，前后要一致！
Email Address []:root@westos.org

将域名解析加入文件，然后删掉之前的仓库容器

[root@server1 ~]# vim /etc/hosts
[root@server1 ~]# docker rm -f registry
registry

运行仓库（重新映射端口为443）

[root@server1 ~]# docker run -d --name registry -v /opt/registry:/var/lib/egistry -p 443:443 -v "$(pwd)"/certs:/certs  -e REGISTRY_HTTP_ADDR=0.0.0.0:443 -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/westos.org.crt -e REGISTRY_HTTP_TLS_KEY=/certs/westos.org.key registry
03caa0f0d79da69f794e36adbaef4d0214622ec2bb04cd6e592979192ac3201d

将前面生成的证书移到指定目录并改名

[root@server1 ~]# cd /etc/docker/
[root@server1 docker]# mkdir certs.d/
[root@server1 docker]# cd certs.d/
[root@server1 certs.d]# ls
[root@server1 certs.d]# mkdir reg.westos.org
[root@server1 certs.d]# cd reg.westos.org/
[root@server1 reg.westos.org]# ls
[root@server1 reg.westos.org]# cp ~/certs/westos.org.crt ca.crt
[root@server1 reg.westos.org]# ls
ca.crt

尝试给仓库上传镜像，先改标签再上传

[root@server1 ~]# docker tag nginx:latest reg.westos.org/nginx:latest
[root@server1 reg.westos.org]# docker push reg.westos.org/nginx:latest
The push refers to repository [reg.westos.org/nginx]
550333325e31: Pushed 
22ea89b1a816: Pushed 
a4d893caa5c9: Pushed 
0338db614b95: Pushed 
d0f104dc0a1f: Pushed 
latest: digest: sha256:179412c42fe3336e7cdc253ad4a2e03d32f50e3037a860cf5edbeb1aaddb915c size: 1362

上传成功！

我们再访问仓库，可以看到仓库我们刚刚上传的镜像

[root@server1 reg.westos.org]# curl -k https://reg.westos.org/v2/_catalog
{"repositories":["nginx"]}

下载加密工具

[root@server1 ~]# mkdir auth
[root@server1 ~]# cd auth/
[root@server1 auth]# ls
[root@server1 auth]# cd ..
[root@server1 ~]# yum install -y httpd-tools

以加密的方式添加用户并设置密码，在这个目录下设置的用户都是可以登录仓库的用户

[root@server1 ~]# htpasswd -Bc auth/htpasswd admin
New password: 
Re-type new password: 
Adding password for user admin
[root@server1 ~]# cat auth/htpasswd 
admin:$2y$05$ewTGoT.xK5M5cixVAvRNguOcbBWevqW0MFCVrFEEP5fkrWOd90jgK
[root@server1 ~]# htpasswd -B auth/htpasswd admin
New password: 
Re-type new password: 
Updating password for user admin
[root@server1 ~]# htpasswd -B auth/htpasswd yang
New password: 
Re-type new password: 
Adding password for user yang
[root@server1 ~]# cat auth/htpasswd 
admin:$2y$05$lj1C1OEewypcTH5qU1IihOCR5N2tYR27bVTeDh5lYpl6y14Iv4xtq
yang:$2y$05$MXf/PwCOBhaSj6aBSZzdOOb5aDW3q7pNM8MTCugzZpwiFR/jzTnvC

改一下路径

[root@server1 auth]# rm -fr certs/
[root@server1 auth]# ls
auth  htpasswd
[root@server1 auth]# rm -fr auth/
[root@server1 auth]# cd ..
[root@server1 ~]# ls
anaconda-ks.cfg  base-debian10.tar  docker                              Dockerfile                            nginx.tar
auth             certs              docker-compose-Linux-x86_64-1.27.0  harbor-offline-installer-v1.10.1.tgz  registry2.tar

以绝对路径的方式指定需要的文件，运行容器

[root@server1 ~]# docker run -d --name registry -v /opt/registry:/var/lib/egistry -p 443:443 -v /root/certs:/certs  -e REGISTRY_HTTP_ADDR=0.0.0.0:443 -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/westos.org.crt -e REGISTRY_HTTP_TLS_KEY=/certs/westos.org.key -v /root/auth:/auth  -e "REGISTRY_AUTH=htpasswd" -e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm"  -e "REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd" registry
9151d22e524930ca93821f17b7395c4d312c7b9ddbac87e068842c8c89de9bbe

运行成功！
现在其他主机需要持有证书并且登录才可以访问仓库！