环境
序号 | 主机IP | 主机名 | 系统 | 备注 |
1 | 192.168.3.117 | stu | rockylinux8.6 | 最小化安装 |
2 | 192.168.3.119 | myhub | rockylinux8.6 | 最小化安装 |
1、关闭selinux及防火墙
sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config
systemctl disable firewalld
systemctl stop firewalld
reboot
2、修改/etc/hosts文件
echo '192.168.3.117 stu' >> /etc/hosts
echo '192.168.3.119 myhub' >> /etc/hosts
3、配置yum源
sed -e 's|^mirrorlist=|#mirrorlist=|g' \
-e 's|^#baseurl=http://dl.rockylinux.org/$contentdir|baseurl=https://mirrors.aliyun.com/rockylinux|g' \
-i.bak \
/etc/yum.repos.d/Rocky-*.repo
dnf makecache
4、安装基础软件包
yum install -y yum-utils device-mapper-persistent-data lvm2 vim net-tools bash-completion
5、安装docker源
yum-config-manager --add-repo https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
sed -i 's+download.docker.com+mirrors.aliyun.com/docker-ce+' /etc/yum.repos.d/docker-ce.repo
一、使用registry搭建私有仓库
1、安装docker
yum install -y docker-ce
systemctl start docker && systemctl enable docker
2、修改内核参数
modprobe br_netfilter
echo "modprobe br_netfilter" >> /etc/profile
cat > /etc/sysctl.d/docker.conf <<EOF
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
net.ipv4.ip_forward = 1
EOF
sysctl -p /etc/sysctl.d/docker.conf
systemctl restart docker
3、在myhub上拉取镜像
docker pull registry:latest
docker images
在stu上拉取镜像
docker pull httpd
docker pull nginx
docker pull busybox
4、启动(在myhub上运行)
docker run -d --name myhub -p 5000:5000 -v /myhub/registry:/var/lib/registry registry:latest
docker ps
netstat -antup | grep 5000
Registry存放镜像的目录是/var/lib/registry目录下,如果容器被删除,则存放于容器中的镜像也会丢失,所以指定本地物理机一个目录如/myhub/registry挂载到容器的/var/lib/registry下,容器删除后镜像不会丢失。-v参数用于指定本地持久目录。
在 stu(192.168.3.117)上修改
vim /etc/docker/daemon.json
改为如下:
{
"insecure-registries": [ "myhub:5000" ]
}
systemctl daemon-reload
systemctl restart docker
5、上传镜像至仓库
docker tag busybox:latest myhub:5000/busybox:latest
docker tag nginx:latest myhub:5000/nginx:latest
docker tag httpd:latest myhub:5000/httpd:latest
docker images
上传
docker push myhub:5000/busybox
docker push myhub:5000/httpd
docker push myhub:5000/nginx
删除镜像
docker rmi myhub:5000/busybox:latest
docker rmi myhub:5000/httpd:latest
docker rmi myhub:5000/nginx:latest
docker rmi nginx:latest
docker rmi httpd:latest
docker rmi busybox:latest
docker images
在myhub上查看
ls /myhub/registry/docker/registry/v2/repositories/
6、测试(192.168.3.117 stu)
docker run myhub:5000/busybox:latest echo "hello"
docker images
运行nginx容器
docker run -d -p 8080:80 myhub:5000/nginx
docker ps
curl 192.168.3.117:8080
拉取httpd镜像
docker pull myhub:5000/httpd
docker images
删除仓库(myhub)
docker rm -f myhub
二、使用harbor搭建私有仓库
Harbor是由VMware公司开源的企业级的Docker Registry管理项目,它包括权限管理(RBAC)、LDAP、日志审核、管理界面、自我注册、镜像复制和中文支持等功能
https://github.com/goharbor/harborhttps://github.com/goharbor/harbor下载offline包2.6.0
https://github.com/goharbor/harbor/releases/download/v2.6.0/harbor-offline-installer-v2.6.0.tgz
下载docker-compose
https://github.com/docker/compose/releases/download/v2.11.0/docker-compose-linux-x86_64
1、安装docker-compose
上传docker-compose-linux-x86_64至/root
mv docker-compose-linux-x86_64 /usr/local/bin/docker-compose
chmod +x /usr/local/bin/docker-compose
2、生成ca证书
mkdir /data/ssl -p
cd /data/ssl/
openssl genrsa -out ca.key 2048
openssl req -new -x509 -days 365 -key ca.key -out ca.pem
Country Name (2 letter code) [XX]: CN
State or Province Name (full name) []:xinjiang
Locality Name (eg, city) [Default City]:urumqi
Organization Name (eg, company) [Default Company Ltd]:myhub
Organizational Unit Name (eg, section) []:CA
Common Name (eg, your name or your server's hostname) []:myhub
Email Address []:23939296@qq.com
3、生成域名证书
openssl genrsa -out myhub.key 2048
openssl req -new -key myhub.key -out myhub.csr
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:xinjiang
Locality Name (eg, city) [Default City]:urumqi
Organization Name (eg, company) [Default Company Ltd]:myhub
Organizational Unit Name (eg, section) []:CA
Common Name (eg, your name or your server's hostname) []:myhub
Email Address []:23939296@qq.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
openssl x509 -req -in myhub.csr -CA ca.pem -CAkey ca.key -CAcreateserial -out myhub.pem -days 365
openssl x509 -noout -text -in myhub.pem
4、安装harbor
mkdir /data/install -p
cd /data/install/
ll /data/ssl
上传离线包至此目录 /data/install
tar -xvf harbor-offline-installer-v2.6.0.tgz
cd harbor
cp harbor.yml.tmpl harbor.yml
vim harbor.yml
hostname: myhub
certificate: /data/ssl/myhub.pem
private_key: /data/ssl/myhub.key
harbor_admin_password: password
docker load -i harbor.v2.6.0.tar.gz
./install.sh
5、 停止harbor
cd /data/install/harbor
docker-compose stop
6、启动harbor
cd /data/install/harbor
docker-compose start
访问:
https://192.168.3.119 或 https://myhub (需修改hosts 192.168.3.119 myhub)
新建项目myregistry
7、在192.168.3.117上测试
vim /etc/docker/daemon.json
改为如下:
{
"insecure-registries": [ "192.168.3.119","myhub" ]
}
systemctl daemon-reload
systemctl restart docker
docker login 192.168.3.119
上传镜像至仓库
docker tag myhub:5000/busybox:latest 192.168.3.119/myregistry/busybox:v1
docker tag myhub:5000/nginx 192.168.3.119/myregistry/nginx
docker push 192.168.3.119/myregistry/busybox:v1
docker push 192.168.3.119/myregistry/nginx
删除镜像
docker rmi 192.168.3.119/myregistry/nginx
docker rmi 192.168.3.119/myregistry/busybox:v1
docker rmi myhub:5000/nginx
docker rmi myhub:5000/httpd
docker rmi myhub:5000/busybox
docker images
8、查看myhub
9、测试(192.168.3.117 stu)
docker run 192.168.3.119/myregistry/busybox:v1 echo "hello"
docker images
运行nginx容器
docker run -d -p 8090:80 192.168.3.119/myregistry/nginx
docker ps
curl 192.168.3.117:8090