docker私有仓库搭建(registry，harbor)

环境

序号	主机IP	主机名	系统	备注
1	192.168.3.117	stu	rockylinux8.6	最小化安装
2	192.168.3.119	myhub	rockylinux8.6	最小化安装

1、关闭selinux及防火墙

sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config
systemctl disable firewalld
systemctl stop firewalld
reboot

2、修改/etc/hosts文件

echo '192.168.3.117 stu' >> /etc/hosts
echo '192.168.3.119 myhub' >> /etc/hosts

3、配置yum源

sed -e 's|^mirrorlist=|#mirrorlist=|g' \
    -e 's|^#baseurl=http://dl.rockylinux.org/$contentdir|baseurl=https://mirrors.aliyun.com/rockylinux|g' \
    -i.bak \
    /etc/yum.repos.d/Rocky-*.repo

dnf makecache

4、安装基础软件包

yum install -y yum-utils device-mapper-persistent-data lvm2 vim net-tools bash-completion

5、安装docker源

yum-config-manager --add-repo https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
sed -i 's+download.docker.com+mirrors.aliyun.com/docker-ce+' /etc/yum.repos.d/docker-ce.repo

一、使用registry搭建私有仓库

1、安装docker

yum install -y  docker-ce
systemctl start docker && systemctl enable docker

2、修改内核参数

modprobe br_netfilter
echo "modprobe br_netfilter" >> /etc/profile
cat > /etc/sysctl.d/docker.conf <<EOF
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
net.ipv4.ip_forward = 1
EOF
sysctl -p /etc/sysctl.d/docker.conf
systemctl restart docker

3、在myhub上拉取镜像

docker pull registry:latest
docker images

在stu上拉取镜像

docker pull httpd
docker pull nginx
docker pull busybox

 4、启动（在myhub上运行）

docker run -d --name myhub -p 5000:5000 -v /myhub/registry:/var/lib/registry   registry:latest

docker ps
netstat  -antup | grep 5000

Registry存放镜像的目录是/var/lib/registry目录下，如果容器被删除，则存放于容器中的镜像也会丢失，所以指定本地物理机一个目录如/myhub/registry挂载到容器的/var/lib/registry下，容器删除后镜像不会丢失。-v参数用于指定本地持久目录。

在 stu(192.168.3.117）上修改

vim /etc/docker/daemon.json
改为如下：
{
"insecure-registries": [ "myhub:5000" ]
}

systemctl daemon-reload
systemctl restart docker

5、上传镜像至仓库

docker tag busybox:latest myhub:5000/busybox:latest
docker tag nginx:latest myhub:5000/nginx:latest
docker tag httpd:latest myhub:5000/httpd:latest
docker images

 上传

docker push myhub:5000/busybox
docker push myhub:5000/httpd
docker push myhub:5000/nginx

删除镜像

docker rmi myhub:5000/busybox:latest
docker rmi myhub:5000/httpd:latest
docker rmi myhub:5000/nginx:latest
docker rmi nginx:latest
docker rmi httpd:latest
docker rmi busybox:latest
docker images

在myhub上查看

ls /myhub/registry/docker/registry/v2/repositories/

 6、测试（192.168.3.117 stu)

docker run myhub:5000/busybox:latest  echo "hello"
docker images

 运行nginx容器

docker run -d -p 8080:80 myhub:5000/nginx
docker ps
curl 192.168.3.117:8080

拉取httpd镜像

docker pull myhub:5000/httpd
docker images

删除仓库(myhub)

docker rm -f myhub

二、使用harbor搭建私有仓库 

Harbor是由VMware公司开源的企业级的Docker Registry管理项目，它包括权限管理(RBAC)、LDAP、日志审核、管理界面、自我注册、镜像复制和中文支持等功能

https://github.com/goharbor/harborhttps://github.com/goharbor/harbor下载offline包2.6.0

https://github.com/goharbor/harbor/releases/download/v2.6.0/harbor-offline-installer-v2.6.0.tgz

下载docker-compose

https://github.com/docker/compose/releases/download/v2.11.0/docker-compose-linux-x86_64

1、安装docker-compose

 上传docker-compose-linux-x86_64至/root

mv docker-compose-linux-x86_64 /usr/local/bin/docker-compose
chmod +x /usr/local/bin/docker-compose

2、生成ca证书

mkdir /data/ssl -p
cd /data/ssl/
openssl genrsa -out ca.key 2048
openssl req -new -x509 -days 365 -key ca.key -out ca.pem

Country Name (2 letter code) [XX]: CN
State or Province Name (full name) []:xinjiang
Locality Name (eg, city) [Default City]:urumqi      
Organization Name (eg, company) [Default Company Ltd]:myhub
Organizational Unit Name (eg, section) []:CA
Common Name (eg, your name or your server's hostname) []:myhub
Email Address []:23939296@qq.com

3、生成域名证书

openssl genrsa -out myhub.key  2048
openssl req -new -key myhub.key -out myhub.csr

Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:xinjiang
Locality Name (eg, city) [Default City]:urumqi
Organization Name (eg, company) [Default Company Ltd]:myhub
Organizational Unit Name (eg, section) []:CA
Common Name (eg, your name or your server's hostname) []:myhub
Email Address []:23939296@qq.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

openssl x509 -req -in myhub.csr -CA ca.pem -CAkey ca.key -CAcreateserial -out myhub.pem -days 365
openssl x509 -noout -text -in myhub.pem

 

 4、安装harbor

mkdir /data/install -p
cd /data/install/
ll /data/ssl

 

上传离线包至此目录  /data/install

tar -xvf harbor-offline-installer-v2.6.0.tgz
cd harbor
cp harbor.yml.tmpl harbor.yml
vim harbor.yml

hostname: myhub

certificate: /data/ssl/myhub.pem

private_key: /data/ssl/myhub.key

harbor_admin_password: password

docker load -i harbor.v2.6.0.tar.gz
./install.sh

5、 停止harbor

cd /data/install/harbor
docker-compose stop

6、启动harbor

cd /data/install/harbor
docker-compose start

访问：

https://192.168.3.119    或   https://myhub  (需修改hosts  192.168.3.119 myhub)

新建项目myregistry

7、在192.168.3.117上测试

vim /etc/docker/daemon.json
改为如下：
{
"insecure-registries": [ "192.168.3.119","myhub" ]
}

systemctl daemon-reload
systemctl restart docker

docker login 192.168.3.119

 上传镜像至仓库

docker tag myhub:5000/busybox:latest 192.168.3.119/myregistry/busybox:v1
docker tag myhub:5000/nginx 192.168.3.119/myregistry/nginx
docker push 192.168.3.119/myregistry/busybox:v1
docker push 192.168.3.119/myregistry/nginx

删除镜像 

docker rmi 192.168.3.119/myregistry/nginx
docker rmi 192.168.3.119/myregistry/busybox:v1
docker rmi myhub:5000/nginx
docker rmi myhub:5000/httpd
docker rmi myhub:5000/busybox
docker images

 8、查看myhub

  9、测试（192.168.3.117 stu)

docker run 192.168.3.119/myregistry/busybox:v1  echo "hello"
docker images

运行nginx容器

docker run -d -p 8090:80 192.168.3.119/myregistry/nginx
docker ps
curl 192.168.3.117:8090