docker之registry加密仓库及其访问控制

一、registry私有仓库实现加密仓库

在/media目录下创建目录registry，用于存放registry私有仓库的镜像数据

[root@server1 ~]# cd /media/
[root@server1 media]# mkdir registry

配置服务端（server1）：
1、创建certs证书，生成服务器私钥

[root@server1 ~]# cd /mnt/docker/ 
[root@server1 docker]# mkdir certs   #在哪个目录下创建certs都可以,该目录的名字随意给
[root@server1 docker]# openssl req -newkey rsa:4096 -nodes -sha256 -keyout certs/xin.org.key -x509 -days 365 -out certs/xin.org.crt   #必须在certs目录的上一层目录执行(由命令决定的)
Generating a 4096 bit RSA private key
..........................................................................................................++
..........++
writing new private key to 'certs/xin.org.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:cn   #国家的名字
State or Province Name (full name) []:shanxi   #省的名字
Locality Name (eg, city) [Default City]:xi'an   #市的名字
Organization Name (eg, company) [Default Company Ltd]:linux   #公司的名字
Organizational Unit Name (eg, section) []:redhat   #部门的名字
Common Name (eg, your name or your server's hostname) []:xin.org   #域名(必须上面指定的xin.org)
Email Address []:root@xin.com   #email地址

查看证书、私钥

2、启动仓库

[root@server1 certs]# cd ..
[root@server1 docker]# docker run -d \   #必须在certs目录的上一层目录执行(由命令决定的)
> --restart=always \      #表示开机自启
> --name registry1 \
> -v "$(pwd)"/certs:/certs \
> -e REGISTRY_HTTP_ADDR=0.0.0.0:443 \   #必须是0.0.0.0:443
> -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/xin.org.crt \
> -e REGISTRY_HTTP_TLS_KEY=/certs/xin.org.key \
> -p 443:443 \
> -v /media/registry:/var/lib/registry \
> registry:2.3.1

查看运行的registry1容器

查看443端口（https）

3、编写/etc/hosts文件，增加域名解析

[root@server1 ~]# vim /etc/hosts
172.25.83.1    server1 xin.org

4、上传xin.org/rhel7:nginx4

[root@server1 ~]# docker tag rhel7:nginx4 xin.org/rhel7:nginx4
[root@server1 ~]# cd /etc/docker/
[root@server1 docker]# mkdir certs.d   #该目录的名字必须是certs.d目录
[root@server1 docker]# cd certs.d/
[root@server1 certs.d]# mkdir xin.org   #该目录的名字必须是xin.org(前面指定的域名)
[root@server1 certs.d]# cd xin.org/
[root@server1 xin.org]# cp /mnt/docker/certs/xin.org.crt ca.crt   #这个证书的名字可以随意给
[root@server1 xin.org]# ls
ca.crt
[root@server1 xin.org]# docker push xin.org/rhel7:nginx4 
The push refers to repository [xin.org/rhel7]
9fd85e6ca660: Pushed   #显示Pushed表示上传成功 
668afdbd4462: Pushed 
nginx4: digest: sha256:96f12a4c433231a0c36d20af593dba0c135fed0aa2d3c180c2c00ac2a9cd5867 size: 739

测试:
1、在server2上编写/etc/hosts文件，增加域名解析；获取证书；并进行测试：下载xin.org/rhel7:nignx4
<1>编写/etc/hosts文件，增加域名解析

<2>获取证书

[root@foundation83 ~]# mkdir /etc/docker/certs.d/xin.org -p   #目录的名字必须是这个
[root@server1 xin.org]# scp /etc/docker/certs.d/xin.org/ca.crt root@172.25.83.83:/etc/docker/certs.d/xin.org/   #将server1上的ca.crt文件复制到物理机的/etc/docker/certs.d/xin.org目录下

<3>测试：下载xin.org/rhel7:nignx4

[root@server2 ~]# docker pull xin.org/rhel7:nginx4
nginx4: Pulling from rhel7
269521def953: Pull complete   #看到Pull complete表示pull成功
ff969636d6bb: Pull complete 
Digest: sha256:96f12a4c433231a0c36d20af593dba0c135fed0aa2d3c180c2c00ac2a9cd5867
Status: Downloaded newer image for xin.org/rhel7:nginx4
改名：
[root@server2 ~]# docker tag xin.org/rhel7:nginx4 rhel7:nginx4
[root@server2 ~]# docker rmi xin.org/rhel7:nginx4 

二.加密仓库的访问控制

1.生成鉴权密码文件

[root@server1 ~]# cd /mnt/docker/
[root@server1 docker]# mkdir auth    #在哪个目录下创建auth都可以,该目录的名字随意给
[root@server1 docker]# docker run --entrypoint htpasswd registry:2.3.1 -Bbn westoswestos  > auth/htpasswd   #用户westos(第一个),密码westos(第二个)。必须在auth目录的上一层目录执行(由命令决定的)。其中auth/htpasswd名字可以随便给,但是--entrypoint后面必须是htpasswd。这里>表示重定向，如果还要添加，需要用>>，否则会覆盖之前的。

2.查看生成的认证密码

查看生成的容器（没有在运行）

3.删除仓库registry1（映射到本地主机的443端口），并删除之前存放registry私有仓库的镜像数据的目录（/media/registry）下的数据，防止冲突。

[root@server1 auth]# docker ps
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS                            NAMES
ea3602dd0021        registry:2.3.1      "/bin/registry /etc/…"   13 hours ago        Up 24 minutes       0.0.0.0:443->443/tcp, 5000/tcp   registry1
[root@server1 auth]# docker rm -f registry1
[root@server1 auth]# cd /media/registry/
[root@server1 registry]# ls
docker
[root@server1 registry]# rm -rf docker/
[root@server1 registry]# ls

4、启动registry1

[root@server1 registry]# cd /mnt/docker
[root@server1 docker]# docker run -d \   #必须在certs目录的上一层目录执行(由命令决定的)
> --restart=always \
> --name registry1 \
> -v "$(pwd)"/certs:/certs \
> -e REGISTRY_HTTP_ADDR=0.0.0.0:443 \
> -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/xin.org.crt \
> -e REGISTRY_HTTP_TLS_KEY=/certs/xin.org.key \
> -p 443:443 \
> -v /media/registry:/var/lib/registry \
> -v "$(pwd)"/auth:/auth \   
> -e "REGISTRY_AUTH=htpasswd" \   
> -e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" \
> -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \   
> registry:2.3.1

查看运行的registry1容器

查看443端口（https）

5、用户登录

[root@server1 docker]# docker login xin.org
Username: westos #用户westos
Password:    #密码westos
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store
 
Login Succeeded

登陆成功之后，会生成，相应的认证文件。下次不用再登录。

6、上传xin.org/rhel7:nginx4（上传的镜像随意选，但是/前面必须是前面设定的域名xin.org）

[root@server1 docker]# docker tag rhel7:nginx4 xin.org/rhel7:nginx4
[root@server1 .docker]# docker push xin.org/rhel7:nginx4 
The push refers to repository [xin.org/rhel7]
9fd85e6ca660: Pushed   #显示Pushed表示上传成功
668afdbd4462: Pushed 
nginx4: digest: sha256:96f12a4c433231a0c36d20af593dba0c135fed0aa2d3c180c2c00ac2a9cd5867 size: 739

server2测试：

<1>登录进行认证

[root@server2 kiosk]# docker rmi rhel7:nginx4   #删除上次实验pull的镜像
[root@server2 kiosk]# docker login xin.org   #或docker login -u westos -p westos 172.25.83.1
Username: westos  #用户westos
Password:       #密码:westos
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store
 
Login Succeeded
 
#退出xin.org命令为:docker logout xin.org  

<2>下载xin.org/rhel7:nignx4

[root@foundation83 kiosk]# docker pull xin.org/rhel7:nginx4
#改名
[root@server2 ~]# docker tag xin.org/rhel7:nginx4 rhel7:nginx4
[root@server2 ~]# docker rmi xin.org/rhel7:nginx4