【registry】CentOS7.x上 registry server的安装使用

一、实验背景

当执行 docker pull 的时候，你可能会比较好奇，docker 会去哪儿查找并下载镜像呢？ 

它实际上是从 registry.hub.docker.com 这个地址去查找，这就是Docker公司为我们提供的公共仓库，上面的镜像，大家都可以看到，也可以使用。所以，我们也可以带上仓库地址去拉取镜像，如：docker pull registry.hub.docker.com/library/alpine，不过要注意，这种方式下载的镜像的默认名称就会长一些。 

 

如果要在公司中使用 Docker，我们基本不可能把商业项目上传到公共仓库中，那如果要多个机器共享，又能怎么办呢？正因为这种需要，所以私有仓库也就有用武之地了。 所谓私有仓库，也就是在本地（局域网）搭建的一个类似公共仓库的东西，搭建好之后，我们可以将镜像提交到私有仓库中。这样我们既能使用 Docker 来运行我们的项目镜像，也避免了商业项目暴露出去的风险。

 

# ping registry.hub.docker.com

# echo > /dev/tcp/3.224.62.138/80

# echo > /dev/tcp/3.224.62.138/443

# echo > /dev/tcp/registry.hub.docker.com/80

# echo > /dev/tcp/registry.hub.docker.com/443

# curl -I http://registry.hub.docker.com

# curl -I https://registry.hub.docker.com

 

 

# docker search alpine

# docker pull alpine

# docker pull registry.hub.docker.com/library/alpine

# docker images

二、实验环境

 

操作系统： CentOS7.5 Minimal

registryServer： 192.168.1.105

registryClient： 192.168.1.102

 

三、安装docker

 

在registryServer和registryClient服务器

 

下载docker二进制安装包

# yum  -y install   wget 

# wget   https://download.docker.com/linux/static/stable/x86_64/docker-18.06.0-ce.tgz

#  tar -zxf   docker-18.06.0-ce.tgz

#  ll   ./docker

# cp ./docker/docker*   /usr/bin

 创建docker服务的unit文件

# vim  /etc/systemd/system/docker.service

##############################################################

[Unit]

Description=Docker Application Container Engine

Documentation=https://docs.docker.com

After=network-online.target firewalld.service

Wants=network-online.target

[Service]

Type=notify

# the default is not to use systemd for cgroups because the delegate issues still

# exists and systemd currently does not support the cgroup feature set required

# for containers run by docker

ExecStart=/usr/bin/dockerd

ExecReload=/bin/kill -s HUP $MAINPID

# Having non-zero Limit*s causes performance problems due to accounting overhead

# in the kernel. We recommend using cgroups to do container-local accounting.

LimitNOFILE=infinity

LimitNPROC=infinity

LimitCORE=infinity

# Uncomment TasksMax if your systemd version supports it.

# Only systemd 226 and above support this version.

#TasksMax=infinity

TimeoutStartSec=0

# set delegate yes so that systemd does not reset the cgroups of docker containers

Delegate=yes

# kill only the docker process, not all processes in the cgroup

KillMode=process

# restart the docker process if it exits prematurely

Restart=on-failure

StartLimitBurst=3

StartLimitInterval=60s

[Install]

WantedBy=multi-user.target

#######################################################

启动docker服务，设置开机自启

# systemctl daemon-reload

# systemctl start docker

# systemctl  status docker

# systemctl enable docker

# docker  info

# docker  version

设置镜像加速

#  curl -sSL https://get.daocloud.io/daotools/set_mirror.sh | sh -s http://f1361db2.m.daocloud.io

#  systemctl restart docker

 

四、安装 registry server

 

拉取docker registry官方镜像

# docker pull registry

# docker run -it --rm registry    cat /etc/shells

# docker run -it --rm registry    cat /etc/issue

# docker run -it --rm registry    sh -c "registry -h"

# docker run -it --rm registry     sh -c "registry -v"

创建registry server相关目录

#  mkdir   -p  /opt/registry/data

#  mkdir  -p  /opt/registry/config

#  mkdir -p   /opt/registry/certs

# mnkir  -p  /opt/registry/auth

 

生产外挂配置文件

# docker run -it --rm registry sh -c   'cat /etc/docker/registry/config.yml'   >  /opt/registry/config/config.yml

#  cat  /opt/registry/config/config.yml 

自建CA，生成自签名证书

##########################################################

# openssl req -x509 \

  -nodes \

  -newkey rsa:4096 \

  -days 3650 \

  -sha256 \

  -subj "/C=CN/ST=Gunagdong/L=Shenzhen/O=CA/OU=CA/CN=www.ca.com" \

  -keyout /opt/registry/certs/ca.key \

  -out    /opt/registry/certs/ca.crt

 

# openssl req \

  -nodes \

  -newkey rsa:4096 \

  -sha256 \

  -subj "/C=CN/ST=Gunagdong/L=Shenzhen/O=Test/OU=Test/CN=www.registry.com" \

  -keyout /opt/registry/certs/registry.key \

  -out    /opt/registry/certs/registry.csr

echo "

authorityKeyIdentifier=keyid,issuer

basicConstraints=CA:FALSE

keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment

subjectAltName=IP:192.168.1.105,DNS:www.registry.com

" > extfile.cnf

 

# openssl x509 -req \

  -days 3650 \

  -CAcreateserial \

  -CA    /opt/registry/certs/ca.crt \

  -CAkey /opt/registry/certs/ca.key \

  -extfile extfile.cnf \

  -in  /opt/registry/certs/registry.csr \

  -out /opt/registry/certs/registry.crt

#####################################################################

#  ls -l   /opt/registry/certs

生成认证用账号密码文件

# docker run   --entrypoint  htpasswd  registry -Bbn  test  Test@123  >   /opt/registry/auth/htpasswd

# cat  /opt/registry/auth/htpasswd

创建服务的service文件

#  vim  /etc/systemd/system/registry.service  

################################################

[Unit]

Description=Registry Server

After=network-online.target docker.service

Requires=docker.service

[Service]

ExecStartPre=-/usr/bin/docker rm -f registry

ExecStart=/usr/bin/docker run \

  --name registry \

  -v /opt/registry/data:/var/lib/registry \

  -v /opt/registry/config/config.yml:/etc/docker/registry/config.yml \

  -v /opt/registry/certs:/certs \

  -e REGISTRY_HTTP_ADDR=0.0.0.0:443 \

  -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/registry.crt \

  -e REGISTRY_HTTP_TLS_KEY=/certs/registry.key \

  -v /opt/registry/auth:/auth \

  -e "REGISTRY_AUTH=htpasswd" \

  -e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" \

  -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \

  -p 443:443 \

  registry

ExecStop=/usr/bin/docker stop registry

LimitNOFILE=65535

Restart=on-failure

StartLimitBurst=3

StartLimitInterval=60s

[Install]

WantedBy=multi-user.target

################################################

启动服务，设置开机自启

# systemctl daemon-reload

# systemctl start registry

# systemctl enable registry

# systemctl status registry

 

# docker ps -a 

# docker exec -it registry sh -c "ps aux | grep registry"

# docker exec -it registry sh -c "netstat -anpltu"

 

五、registryClient客户端测试

 

方式一：通过获取registryServer的CA证书

将服务端证书/opt/registry/certs/ca.crt 拷贝到了客户端的 /etc/pki/ca-trust/source/anchors目录下

在registryClient服务器上

#  scp  root@192.168.1.105:/opt/registry/certs/ca.crt   /etc/pki/ca-trust/source/anchors/

# update-ca-trust

# systemctl  restart docker

# cat /etc/pki/ca-trust/source/anchors/ca.crt

# openssl x509 -noout -text -in /etc/pki/ca-trust/source/anchors/ca.crt

 

方式二：不通过CA证书，设置客户端docker信任仓库

# systemctl  status docker

# vim  /etc/systemd/system/docker.service

#####################################################

ExecStart=/usr/bin/dockerd  --insecure-rehistry 192.168.1.105:443

######################################################

# systemctl daemon-reload

# systemctl  restart  docker

 

六、登录创建的docker仓库

 

在registryClient服务器上

 

测试registryserver上443端口的连通性

# echo > /dev/tcp/192.168.1.105/443

# curl -v http://192.168.1.105:443

 

 

# docker login 192.168.1.105:443  -u test  -p  "Test@123"

# cat /root/.docker/config.json

 

测试镜像的pull/push

# docker pull busybox:latest

# docker tag  busybox:latest  192.168.1.105:443/test/busybox:1.0.1-RC1

# docker push 192.168.1.105:443/test/busybox:1.0.1-RC1

 

 

 

七、参考

 

registry

https://hub.docker.com/_/registry

https://docs.docker.com/registry/deploying

 

用registry快速搭建私有镜像仓库

https://blog.51cto.com/ganbing/2080140

 

用docker registry 镜像搭建私有测试仓库

https://www.jianshu.com/p/7337aa3f227b

 

用nginx 反向代理docker 私有 registry

https://www.jianshu.com/p/143255035496

 

x509: cannot validate certificate for xx.xx.xx.xx because it doesn't contain any IP SANs

https://stackoverflow.com/questions/54622879/cannot-validate-certificate-for-ip-address-because-it-doesnt-contain-any-ip-s

 

x509: certificate signed by unknown authority

https://stackoverflow.com/questions/50768317/docker-pull-certificate-signed-by-unknown-authority

 

docker registry 私有仓库 安装配置、查询、删除

https://www.cnblogs.com/elvi/p/8384604.html

https://www.cnblogs.com/elvi/p/8384675.html

 

Docker私有仓库搭建及镜像删除

http://www.louisvv.com/archives/1130.html

 

docker registry 镜像删除

https://blog.51cto.com/132408/1946401

 

docker私有仓库删除image

https://blog.51cto.com/302876016/1966816

https://blog.csdn.net/l6807718/article/details/52886546

 

Docker Registry之删除镜像、垃圾回收

https://blog.csdn.net/u010884123/article/details/56838644

 

What is the difference between an image and a repository?

https://stackoverflow.com/questions/31115098/what-is-the-difference-between-an-image-and-a-repository

 

What is the Differences between Docker registry and repository?

https://stackoverflow.com/questions/34004076/difference-between-docker-registry-and-repository

 

How To Set Up a Private Docker Registry on Ubuntu 18.04？

https://www.digitalocean.com/community/tutorials/how-to-set-up-a-private-docker-registry-on-ubuntu-18-04