再探docker私有仓库，harbor！

harbor的优点

• 基于角色控制
• 基于镜像的复制策略
• 图形UI
• 审计
• RESTful API
• 图像删除和垃圾收集
• 支持LDAP/AD

harbor核心组件

• proxy：通过一个前置的反向代理统一接受浏览器、Docker客户端的请求，并将请求转发给后端不同的服务
• Core services：Harbor的核心功能，包括UI、webhook、token服务
  webhook：是一种反向API机制，类似于触发器
  token：令牌，提供身份验证服务
• Database：为core services提供数据库服务
• Log collector：负责收集其他组件的log，供日后进行分析
• Registry：复制储存Docker镜像，并处理docker push/pull命令

部署harbor

• 安装harbor

[root@server ~]# tar zxf harbor-offline-installer-v1.2.2.tgz -C /usr/local/
[root@server ~]#  chmod +x docker-compose 
[root@server ~]# cp docker-compose /usr/local/bin/

• 配置harbor参数并查看容器

  5 hostname = 192.168.1.101
 56 ##The initial password of Harbor admin, only works for the first time when Harbor starts. 
 57 #It has no effect after the first launch of Harbor.
 58 #Change the admin password from UI after launching Harbor.
 59 harbor_admin_password = Harbor12345		//定义了admin的密码
[root@server harbor]# docker ps -a		//发现多了几个容器
CONTAINER ID   IMAGE                              COMMAND                  CREATED         STATUS                   PORTS                                                                                                                 NAMES
e7b1102deb62   vmware/nginx-photon:1.11.13        "nginx -g 'daemon of…"   3 minutes ago   Up 3 minutes             0.0.0.0:80->80/tcp, :::80->80/tcp, 0.0.0.0:443->443/tcp, :::443->443/tcp, 0.0.0.0:4443->4443/tcp, :::4443->4443/tcp   nginx
d0230fb3c0a8   vmware/harbor-jobservice:v1.2.2    "/harbor/harbor_jobs…"   3 minutes ago   Up 3 minutes                                                                                                                                   harbor-jobservice
800c9b6f3a80   vmware/harbor-ui:v1.2.2            "/harbor/harbor_ui"      3 minutes ago   Up 3 minutes                                                                                                                                   harbor-ui
13a3120c01d1   vmware/harbor-db:v1.2.2            "docker-entrypoint.s…"   3 minutes ago   Up 3 minutes             3306/tcp                                                                                                              harbor-db
d1bf45eda762   vmware/harbor-adminserver:v1.2.2   "/harbor/harbor_admi…"   3 minutes ago   Up 3 minutes                                                                                                                                   harbor-adminserver
ee0e3861fae3   vmware/registry:2.6.2-photon       "/entrypoint.sh serv…"   3 minutes ago   Up 3 minutes             5000/tcp                                                                                                              registry
cbb9935e86b1   vmware/harbor-log:v1.2.2           "/bin/sh -c 'crond &…"   3 minutes ago   Up 3 minutes             127.0.0.1:1514->514/tcp                                                                                               harbor-log
358d4ade35b1   centos:stress                      "/bin/bash"              3 hours ago     Exited (0) 3 hours ago                                                                                                                         eager_keller
2a3bf404a512   centos:stress                      "/bin/bash"              3 hours ago     Exited (0) 3 hours ago                                                                                                                         mystifying_lovelace
[root@server harbor]# docker-compose ps
       Name                     Command               State                                                  Ports                                                
------------------------------------------------------------------------------------------------------------------------------------------------------------------
harbor-adminserver   /harbor/harbor_adminserver       Up                                                                                                          
harbor-db            docker-entrypoint.sh mysqld      Up      3306/tcp                                                                                            
harbor-jobservice    /harbor/harbor_jobservice        Up                                                                                                          
harbor-log           /bin/sh -c crond && rm -f  ...   Up      127.0.0.1:1514->514/tcp                                                                             
harbor-ui            /harbor/harbor_ui                Up                                                                                                          
nginx                nginx -g daemon off;             Up      0.0.0.0:443->443/tcp,:::443->443/tcp, 0.0.0.0:4443->4443/tcp,:::4443->4443/tcp,                     
                                                              0.0.0.0:80->80/tcp,:::80->80/tcp                                                                    
registry             /entrypoint.sh serve /etc/ ...   Up      5000/tcp                                                

harbor中的七个容器：

• harbor-adminserver

• harbor-db

• harbor-jobservice

• harbor-log

• harbor-ui

• nginx

• registry

• 用web端登入到harbor
  
  

• 创建项目
  

• 用命令行登录到Harbor

[root@server docker]# docker tag cirros:latest 127.0.0.1/myproject/cirros:v1
[root@server docker]# docker login -u admin -p Harbor12345 http://127.0.0.1
WARNING! Using --password via the CLI is insecure. Use --password-stdin.
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded

• 推送镜像

[root@server docker]# docker push 127.0.0.1/myproject/cirros:v1 
The push refers to repository [127.0.0.1/myproject/cirros]
984ad441ec3d: Pushed 
f0a496d92efa: Pushed 
e52d19c3bee2: Pushed 
v1: digest: sha256:483f15ac97d03dc3d4dcf79cf71ded2e099cf76c340f3fdd0b3670a40a198a22 size: 943

• 查看日志
  
• 想要使用不是本地的ip地址推送镜像，需要修改

[root@server docker]# vim daemon.json 

{
  "insecure-registries": ["192.168.1.101:5000"],	//删除这一行
  "registry-mirrors": ["https://cn90fxk6.mirror.aliyuncs.com"]
}
[root@server system]# cd /usr/lib/systemd/system
[root@server system]# vim docker.service 
# for containers run by docker
ExecStart=/usr/bin/dockerd -H fd:// --insecure-registry 192.168.1.101 --containerd=/run/containerd/containerd.sock	//加上--insecure-registry 192.168.1.101
[root@server system]# docker login -u admin -p Harbor12345 http://192.168.1.101		//成功登入
WARNING! Using --password via the CLI is insecure. Use --password-stdin.
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded
		

• 将tag打成192.168.1.101再推送

[root@server system]# docker tag nginx:v4 192.168.1.101/myproject/nginx:c1
[root@server system]# docker push 192.168.1.101/myproject/nginx:c1 
The push refers to repository [192.168.1.101/myproject/nginx]
04f0c5f56b6b: Pushed 
174f56854903: Pushed 
c1: digest: sha256:68c8b78dbf84ab2713cffda3a423e03e9202faa830af8ebbeca6e0f8c9eda065 size: 739

• 如何下载镜像

[root@server system]# docker rmi 192.168.1.101/myproject/nginx:c1 
Untagged: 192.168.1.101/myproject/nginx:c1
Untagged: 192.168.1.101/myproject/nginx@sha256:68c8b78dbf84ab2713cffda3a423e03e9202faa830af8ebbeca6e0f8c9eda065
[root@server system]# docker pull 192.168.1.101/myproject/nginx:c1
c1: Pulling from myproject/nginx
Digest: sha256:68c8b78dbf84ab2713cffda3a423e03e9202faa830af8ebbeca6e0f8c9eda065
Status: Downloaded newer image for 192.168.1.101/myproject/nginx:c1
192.168.1.101/myproject/nginx:c1
[root@server system]# docker images
REPOSITORY                      TAG               IMAGE ID       CREATED         SIZE
compose_nginx_nginx             latest            92bee763c9dd   3 hours ago     310MB
centos                          stress            9fc6d16d05f3   5 hours ago     520MB
192.168.1.101/myproject/nginx   c1                64868a58d31b   4 days ago      205MB