docker仓库

一、docker仓库简介

Docker 仓库是用来包含镜像的位置，Docker提供一个注册服务器（Register）来保存多个仓库，每个仓库又可以包含多个具备不同tag的镜像。Docker运行中使用的默认仓库是 Docker Hub 公共仓库。docker hub是docker公司维护的公共仓库，用户可以免费使用，也可以购买私有仓库。

二、私有仓库搭建

[root@server1 nginx]# docker pull registry
[root@server1 nginx]# docker images registry
REPOSITORY   TAG       IMAGE ID       CREATED       SIZE
registry     latest    678dfa38fcfa   5 weeks ago   26.2MB
[root@server1 nginx]# docker run -d --name registry -p 5000:5000 -v /opt/registry:/var/lib/registry registry   %运行registry容器且打入后台并做端口映射。/opt/registry:/var/lib/registry指定容器数据默认挂载点所对应的宿主机目录
7339618d8b82f8823042ca826df90ad0c9cef6351d994e67a5870ba6118760a9
[root@server1 nginx]# netstat -antlp   %查看端口映射是否成功
[root@server1 nginx]# docker tag webserver:last localhost:5000/webserver:latest
[root@server1 nginx]# docker push localhost:5000/webserver
Using default tag: latest
The push refers to repository [localhost:5000/webserver]
6526809a5f26: Pushed 
1d3b68b6972f: Pushed 
de1602ca36c9: Pushed 
latest: digest: sha256:9a8cfaba883c27f2b585e8532c783746b27e4a92705669c6bd27683e5e2c2c3e size: 949
[root@server1 nginx]# curl localhost:5000/v2/_catalog  %搜索上传本地仓库的镜像

三、配置镜像加速器

从docker hub上下载镜像的速度太慢，需要配置镜像加速器，这里以阿里云为例：(需要提前注册阿里云帐号)

配置docker daemon文件：
vim /etc/docker/daemon.json
  {
  "registry-mirrors": ["https://xxxxx.mirror.aliyuncs.com"]   %每一个账户的xxxxx部分均不相同
  }
重载docker服务：
systemctl daemon-reload
systemctl restart docker

四、Docker仓库添加证书加密和用户认证功能

1.证书加密

openssl req   -newkey rsa:4096 -nodes -sha256 -keyout certs/westos.org.key -x509 -days 365 -out certs/westos.org.crt
vim /etc/hosts   %做reg.westos.org的本地解析
docker run -d --name registry -p 443:443 -v /opt/registry:/var/lib/registry -v "$(pwd)"/certs:/certs -e REGISTRY_HTTP_ADDR=0.0.0.0:443 -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/westos.org.crt -e REGISTRY_HTTP_TLS_KEY=/certs/westos.org.key registry

mkdir /etc/docker/certs.d/reg.westos.org/ -p
cp certs/westos.org.crt /etc/docker/certs.d/reg.westos.org/ca.crt
ll /etc/docker/certs.d/reg.westos.org/ca.crt
docker push reg.westos.org/game2048:latest     %上传镜像

2.认证

yum install -y httpd-tools
htpasswd -B -c auth/htpasswd wxh  %创建认证用户及密码
cat auth/htpasswd 
htpasswd -B auth/htpasswd admin
cat auth/htpasswd 
docker rm -f registry 
docker run -d --name registry -p 443:443 -v /opt/registry:/var/lib/registry -v "$(pwd)"/certs:/certs -e REGISTRY_HTTP_ADDR=0.0.0.0:443 -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/westos.org.crt -e REGISTRY_HTTP_TLS_KEY=/certs/westos.org.key -v "$(pwd)"/auth:/auth -e "REGISTRY_AUTH=htpasswd" -e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd registry
docker ps
docker images 
docker tag ubuntu:latest reg.westos.org/ubuntu:latest
docker push reg.westos.org/ubuntu:latest
docker login reg.westos.org
cat /root/.docker/config.json    %登录之后会生成这个文件
docker push reg.westos.org/ubuntu:latest

参考官方链接: https://docs.docker.com/registry/deploying/#get-a-certificate.

五、harbor仓库

有可视化web界面，有对镜像的签名和扫描功能，适合于真实的生产环境

软件下载:https://github.com/goharbor/harbor/releases
部署：（依赖性 docker 17.06.0-ce+ and docker-compose 1.18.0+） 
tar zxf harbor-offline-installer-v1.10.1.tgz
cd harbor
vim harbor.yml
hostname: reg.westos.org
http:
   port: 80
https:
  port: 443
  certificate: /data/certs/westos.org.crt
  private_key: /data/certs/westos.org.key
harbor_admin_password: westos
database:
    password: westos
./install.sh --with-notary --with-clair --with-chartmuseum  %启用签名，启用扫描，启用chart库

部署根证书：
/etc/docker/certs.d/reg.westos.org/ca.crt
~/.docker/tls/reg.westos.org:4443/ca.crt
启用docker内容信任：
export DOCKER_CONTENT_TRUST=1
export DOCKER_CONTENT_TRUST_SERVER=https://reg.westos.org:4443
上传镜像：
docker push reg.westos.org/library/nginx:latest
...
Enter passphrase for root key with ID e42f679: 
Enter passphrase for new repository key with ID 383f503:
删除签名：
docker trust revoke reg.westos.org/library/nginx:latest